Semperis Active Directory Forest Recovery

Semperis Active Directory Forest Recovery (ADFR) is a disaster recovery solution designed to restore Active Directory environments after cyberattacks such as ransomware and wiper attacks. The product automates the AD forest recovery process to reduce downtime from days or weeks to minutes or hours.

ADFR uses patented technology to decouple Active Directory from the underlying operating system, enabling recovery to a known-secure state without reintroducing malware. The solution supports automated backups to immutable Azure storage and can restore AD to any virtual or physical hardware.

The product includes post-attack Identity Forensics and Incident Response (IFIR) capabilities to identify and remove attacker artifacts, backdoors, and compromised accounts. It provides forensic analysis tools that translate unstructured AD and Azure AD change data into human-readable formats, allowing security teams to search, correlate, and undo AD changes at object and attribute levels.

ADFR automates the entire recovery process including metadata cleanup, Global Catalog rebuilding, and site topology restructuring. The solution enables organizations to set up replicas of production AD environments for disaster recovery drills and testing.

The product addresses the challenge of recovering AD after attacks that target domain controllers, providing an alternative to manual 28-step recovery processes documented by Microsoft.