Recovery Manager for Active Directory Reviews

We use Quest Recovery Manager for Active Directory to test disaster recovery, and we use it to restore objects as they get deleted by mistake or mistakes happen.

The feature that automates most of the tasks is the most valuable since you do not have to worry about making sure that you follow the steps one by one manually during a disaster. Basically, automation is the key player.

One of the things they can do is give the user the ability to skip the prechecks and verifications.

I've used the solution for 18 months.

It's very stable. The only complaint I have is the price of the product.

It's scalable. You can easily scale up or down.

Most of the time, their support is pretty good. Sometimes, it could be better.

Positive

The initial setup requires a design and engineering phase. You can't just pick the product and click next, next, finish - especially if you're planning on making sure that it's going to be available during a disaster. It does require sitting down and designing it. So it's not like a home-use product that you can just go and install and start using it with no consequence.

Right now, it is worth the money because even if we save ourselves from one ransomware attack, it will pay for itself within the first couple of hours.

Be willing to pay the extra money. I'd rate the solution ten out of ten.

I use it to recover user objects or any objects within Active Directory, as well as to recover domain controllers, domains, and forests.

The backup automation has enhanced my IT workflow by reducing the amount of manual monitoring needed. 

While backup automation itself isn't new, Quest Recovery Manager sends emails to let me know if a backup is successful and checks its integrity. 

It also notifies me if cloud backups are completed – that's a relatively new feature in the latest version, 10.3.1.

I like the zero-touch or zero-intervention aspect the most when it comes to performing a forest restoration (FOHO). It is really automated. If you set everything correctly, it will restore your forest without any manual steps.

It gives us a good idea of our RTO and RPO – how long it would take to recover our entire forest or a single domain controller in a disaster scenario. So, for me, in terms of potential, I'd scale it a nine out of ten.

Inside the console, when you change something in the computer collection, there's no history or log showing what's been done. For example, if I add or remove a domain controller from the compare collection, the console doesn't record the time or the user who made the change. This makes it difficult to manage the console, especially for auditing purposes. It lacks login capability within Recovery Manager for Active Directory.

This means if I delegate tasks to a level two or an interim level three technician, and they make a mistake, it's difficult to track. Ideally, I'd like to monitor who makes changes within the console to ensure proper management. Currently, that kind of capability isn't available.

I have been using it since 2020. 

It is a very stable solution. I would rate the stability a ten out of ten. No issues here. 

I would rate the scalability an eight out of ten. When you have more than a hundred compare collections inside your console, and each compare collection has an average of two or three domain controllers, the console will not respond in a fast manner and can become slow. 

It has difficulty managing that volume, so I often use the PowerShell module for Quest Recovery Manager instead.

For now, we only have six users, and I'm the only one actively using it right now.

The customer service and support could improve their approach to questioning issues. They tend to ask questions one at a time, which creates a lot of back-and-forth communication. 

It would be helpful if they had checklists for common issues customers encounter, as it could speed up the resolution process. Asking questions back and forth via email isn't always the most efficient way to resolve issues quickly.

I've used Semperis and native backup and recovery solutions by Microsoft.

The initial setup is very easy, honestly. You just have to follow the user guide that they have.

As long as you follow the instructions in the user guide, you should be able to set up and perform your initial configuration inside the console.

The pricing is in the middle. Comparing it to other vendors, it seems to be affordable. So, it is worth the money. 

I would recommend Quest Recovery Manager to others. If someone is looking for an end-to-end backup and disaster recovery solution specifically for Active Directory, Quest is the only tool that currently offers bare metal restore capability.

Overall, I would rate the solution a nine out of ten. 

We primarily use the solution for recovery purposes. 

It has saved our company money in terms of recovering objects, but I can't put a number on that.

The interface and the time to recovery of the objects are great aspects of the solution. The interface is very simple. I didn't have anybody walk me through it. I just went in and said, "Okay, how do I do this?" And it was very slick. It was very simple, and it was very quick.

The menus are streamlined and I could very easily figure out what backup I wanted to go to, how to load it, and how to restore the attributes. I have restored one time—some attributes on an object—and it was very simple. It was very slick and worked really well.

Our impression of the solution for providing a clean, malware-free recovery and protecting our AD backups from compromise is that it is probably one of the best options available. From what I've seen, there are a few vendors that do it in a similar fashion, but what this product does is top-notch. It's a top-tier solution for preventing the reingestion of some type of compromise.

I can't say if it reduces the risk of malware reinfection, but I can definitely say it significantly reduces the possibility of reingestion. It's not doing a full backup of the server, and it's not backing up the driver directory and directories where executable files reside, which is where malware is likely to be hidden. It doesn't have to back those up to do the directory backup. It limits what is backed up and what is restored. 

It is very important to have this ability to eliminate the risk of reinfection. If you suffer a compromise, and you're restoring to a clean environment, the assumption is that it's clean. If you have that same infection, then you're doing a tremendous amount of work and spending a tremendous amount of money, and you're going to suffer the same fate down the road.

I've used the solution for about nine months, but I don't manage it on a day-to-day basis. It's really been a set-and-forget type of thing.

I haven't had to engage support for Recovery Manager for Active Directory.

Positive

Currently, my team uses the CrowdStrike Falcon platform for threat detection and response.

It definitely acts more as an insurance policy. You could have an external attack, an internal attack, or an internal accident that wipes out a lot of directory information. That information can be recovered pretty easily with this tool.

Over the past number of months, I identified a gap with their Recovery Manager for AD Forest Edition. That software can't recover for us if we have a complete malware/ransomware-type scenario where we lose all our domain controllers. If you lose the entire forest, you can't get it back up with the Forest Edition. You have to use their Disaster Recovery Edition. That suite of software can recover from a complete disaster scenario. And that's what I'm looking at right now to determine if we want to purchase that or one of their competitors' solutions.

So I've started down the path of reviewing Quest Recovery Manager for Active Directory Disaster Recovery Edition along with KOsoft and Semperis, to see the different capabilities among the products. My experience with those other products has really just been from talking with the vendors and looking at the product. I haven't done a PoC or had my hands on them.

We've recently started looking at Varonis. That's going to be owned by a different division within the company, however, it applies directly to directory services on my team and its ability to lock down and protect the directory.