I think it would be beneficial for us to see what exact steps it would take to recover from a complete loss of the production environment, as if ransomware broke through and ALL non-hardened systems are presumed compromised. The call is made to “take off and nuke the site from orbit”, wiping all hypervisors down to bare metal (it’s the only way to be sure). The only thing that survives is a hardened Linux, StoreOnce, or cloud-based object storage repository. What do you do to bring the domain online, both in non-domain-joined VMware configurations and “worst case” environments with Hyper-V hypervisors and VBR servers that are also joined to the production domain?
Such a demo would be great to showcase 1) how to recover from complete disaster even if you’re not following best practices concerning domain segmentation, and 2) how following said practices (presumably) would save you a lot of headache in a situation like this. The article linked below covers some of this territory but doesn’t speak to the exact order of operations when it comes to AD domain controller recovery and how could impact domain-dependent hypervisors. It could also use clarity on whether or not an attempt should be made to restore the VBR or Enterprise Manager servers to their previous state via Configuration Backups, or whether the initial goal is to restore everything from a newly downloaded copy of VBR on fresh workgroup-mode install of Windows Server with just the license file applied. In high-stress recovery scenarios like these it helps to see the small details spelled out.
