Name: Rubrik Workshop: Identity Recovery
Uploaded: 2026-01-13T11:46:04.109Z
Duration: 1 h 19 min 4 s
Description: Rubrik Workshop: Identity Recovery

Transcript for "Rubrik Workshop: Identity Recovery": Hello. Good morning. Welcome to this new session of Rubric Identity Workshop. We are just taking some minutes to have everyone online. A lot of people signed up for this webinar, so we are just giving everyone the time to to be online and connected. I'm Francesco Tika. I'm based in Amsterdam. I'm with Rubrik now for three years, and I'm in the marketing and demand generation, and programs, team. Today, I'm here with Salvator Bocollero. Salvatorre is our, great expert on identity, and he will be our master of ceremonies for today's workshop. So off to you, Salvatore. Thank you for joining us, and welcome again, everyone. Thank you, Francesco, and good morning, good afternoon, good wet days in London, and good snowy days in Copenhagen. I can report for myself at least. I'm based in in Copenhagen, Denmark. Yes. My name is Salvatore Boculero. I am part of the SCAM Rubric program since we started it back in 2018. So it's it's been a good number of years. We evolved the format over time. Originally, it was an on-site event where we did a hands on deployment of physical rubric bricks or scale out cluster technology. Today, it's very much virtual that makes it easier to arrange and also accommodate as many people as we are today. That would be too difficult for an on-site event. But, today is about identity recovery. First, I will give you a, a talk on on what we do and and why identity recovery is important. And then you will be, you will have a hands on lab session. It's a click through lab. It's so it's a guided lab or simulated lab, but, it will give you a good idea of how the product actually works because it is it is, screen shared directly from the from the product. We have multiple CAMP Rubric types. This is identity recovery. We have another one we are running, is about Microsoft three six five end to end cyber recovery. And we also have a ransomware recovery lab and and others as well. Cloud labs. So Francesco is the master of all these, labs. But, Yeah. get ahead. comfortable owner of running. them all. Get comfortable, get coffee, get tea, get water. We'll get started in a just a few more minutes when everybody has had a chance to log on. Also, please, you can see here that you can use both the chat and the q and a function. So feel free to ask your questions later after the presentation. If you want to, sorry, intervene speaking, you also have the option to raise your hand and to to come on stage with us and use your microphone. Oh, that voice sounds bad. Francesco, you need to take care of it now. Yeah. I told. you. Good. You have a vacation coming up soon. Alright. Hopefully, everybody can see my slide deck, so I'll get started talking about why identity recovery is is a crucial capability in today's threat landscape. Speaking about identity recovery, we now since August, '25. Yes. We are in 2026. Happy New Year, everybody. In August, we launched our latest addition to the identity program, and we call that identity resilience. So where recovery is about, recovering after an attack, resilience is, is meant to be something that can assist us in the time before an attack. This is meant to give us warning signs and and give us visibility into what changes are being made into the identity provider so we can hopefully capture events before they become full fledged ransomware. But let's let's stay on the topic for now. As Francesco said, you can write in the chat or you can write questions in the q and a. The q and a is probably the best place because then it's easier for us to track what we have answered already. But feel free to use whatever. And as also Francesco said, you can you can jump on stage, and then you can ask your question using a microphone if you have if you have that. Okay. So agenda for today, introductions has been done already. Housekeeping, well, you are where you are. You take care of yourself. Make sure you have breaks and you have coffee, tea, water, whatever you you need. Next is the technical deep dive of the identity recovery followed by q and a, and please feel free to ask questions along the way. And then there will be the guided lab links, so you will have access to run through and see for yourself how it works with Rubrik. As these are click through guided labs, they may not serve all purposes. So if you do have a need for an actual hands on lab where you will experience the product as is instead of a guided click through, let us know, and we can arrange and set up a lab for you. A couple of reasons why we're doing it this way. One is, of course, cost. Every lab we start up has a cost. And, of course, as everybody, we are trying to minimize our cost. But more importantly, the actual recovery of a complete active directory in Forest takes up to two hours with the hair horsepower we have in in our cloud labs. And two hours where most of the time is waiting, we think that's not a good way to spend your an hour time. So instead, we have made these guided click through labs. After the session, we'll wrap up probably around 1,300 CET roughly two hours from now or one hour and fifty two minutes. We may end earlier depending on how many questions and how much interaction we'll get during the event. And now to the slide deck, Rubrik Security Cloud, you probably know about that already. That is our one pane control plane where we access the entire rubric portfolio, where we can manage backups, recoveries, and and many other things. This has been built throughout the last five years. It's it's made to be simple to understand, simple to operate, yet secure and efficient. And it's it's built with some some common principles like immutability, like automation, like zero trust, and and much other things. So it's it's really designed to be a very good and easy to use control plane. So to emphasize the new things here, we have identity recovery that covers active directory. It covers enter ID. It covers Okta now also. And it's built on the the known Rubrik resilience with immutability and and air gaping and and all these things. This is the entire Rubrik Security Cloud as you as as we know it as of today. More things are coming. I'm part of the Rubrik X team where we are launching new products, and we are very much looking forward to agent cloud that will be launched sometime in February. Our our initiative with regards to intelligence, artificial artificial intelligence, AI, and, and agents and these things. But for now, this is how it looks. In short, it's a very there's a lot of details on this. It's it's built for automation. It's built to work with APIs. Overall, it's a native data thread engine. It's actually preemptive as it can see things before they start becoming problems. We have four main pillars, which is data protection, including cloud data protection, backup of of cloud workloads, enterprise data protection, which is backups of of data center workloads wherever they are in your data centers or with some of your your partners. It's about software as a service data protection covering Microsoft three six five, covering Salesforce, covering Jira, and, Dynamics three six five as well. And then unstructured data and then, of course, also identity providers, which is the topic of today. On the right side, we see the integrations we have with leading cyber players in this world, such as Palo Alto, Zscaler, CrowdStrike, Microsoft, and Mentiant. And, yeah. There there's a lot to talk about, but let's let's focus down on on identity recovery here. Most attacks today, they are focused around identity because it's actually much easier to log in instead of brute forcing your way in through firewalls and network isolation and what have you. So the path of least resistance today, that's identity. And the attackers, they use many different mechanisms to get our logins. They can do with just a simple login with no particular permissions, and then they can elevate from there. So it usually is centered around Active Directory. Whether your Active Directory is just a single forest, single domain, or whether you have multiple forests and many domains. If they are connected in the same forest, we see that a breach on one domain controller will usually lead to the fall of all of them in the forest. And a forest is is not easy to to recover. Hence, we need to have a response ready so we can recover Active Directory and Forests quickly and efficiently. If this architecture is breached, then we will see a following problem, which is usually a full scale ransomware attack. Whether they then actually encrypt data or they just only steal sensitive data and threaten to expose it, We see it in different variants. Some use both. Some use only one of them. But both are are pretty, pretty bad. Now let's talk about what we see today that most companies are using to protect their identity platform. As we're talking about active directory and forests, obviously, we have an AD and we have IAM admin folks to manage that. We usually see point based solutions where some software product is making a particular backup of active directory. Sometimes also the forest, but not always. So we need someone to manage that point based solution as well. This point based solution is then backing up the identity provider being Active Directory Forest and usually placing it on an SMB share, sometimes a bucket, in AWS or or in in Azure. But, nevertheless, it's dumping to a location where it's stored as simple files. Then comes eventually the main backup vendor in the shop and runs by this SMB share and protects the data that it backed up from the active directory in forest. And that's usually placed on disk, sometimes on tape, sometimes it's archived to to the cloud. Now this architecture is obviously complicated. We have multiple steps. We have a built in synchronicity issue between the point based solution of the identity provider and the backup vendor providing protection of the the file dumps of the identity provider. So that is limiting how often we can protect the identity solution because if the backup vendor is only backing up the files once a day anyways, what good does it do for us? And also, the backup vendor has no way of knowing if the point based solution was actually complete in its backup or it hasn't started yet or whether it was a consistent backup, meaning that we can actually recover safely from it. And then, obviously, if there is a breach in the identity provider, this whole structure is under siege. It might even be taken offline. All of these components and the first line of duty besides finding out what hit us, when did it hit us, what was affected, then we need to recover the disk storage. How do we do that? We need the backup. How do we get the backup up and running if it was encrypted? How do we get the SMB share? And this point based solution, if it was running on a virtual server that we see mostly, then chances are that will be taken offline as well in the ransomware attack as most ransomware attacks today also destroy the virtualization layer. So even before we start recovering identity provider, which is the baseline of everything, there's so many things, so many questions we need to answer, and this becomes really complicated. Not to mention that, obviously, it's also an expensive solution. It's a complicated solution. We need multiple personas. We need shares, and we need to pay a lot of license money for this. Rubrik can replace all of this. Of course, you might add, we have identity recovery built into our Rubrik, security, cloud. And act again, it's built on the known strong features of Rubrik with a immutability and a zero trust architecture from day one. Not something that's added on later, not something you can enable or disable, but something that's always on. That's how it should be. Because you have to realize that backup requires a higher security standard than other things. Because the backup is your last line of defense. This is what has to stand when everything else fails. This is what needs to be there so you can recover if and when you need it. It's that simple. And, obviously, all statistics are talking about this. We all know it. It is all growing, all the threats we are seeing on our infrastructures. Identity is obviously the keys to the kingdom. This is the thing governing access from users to resources. And if identity is offline, no user can access anything. This is why they want to take off they want to take out your identity provider because it will blind you. And also, this is why they want to attack your backup platform because then it will leave you defenseless because you cannot recover. So those two things need to be extra safeguarded. So, this is essentially just a, repeat of what I already said. What are the challenges with the current approaches? If, you get hit, then the backups might be exposed. That's going to be expensive. Recovery is complex. That's going to take a lot of time. And time is what we don't have when we get hit. It's about multiple tools. So, it's more expensive. It's more complicated. And, again, in these kind of scenarios, simplicity is your friend. Complexity is your enemy. You want to make things as simple as possible. That's actually part of security as well. And what I haven't mentioned already is the limited type of recovery in in most tools. I'll talk a bit more about that later. So to summarize again, why do we need identity recovery? We need assured ability to recover to any point in time. So, again, we need a high amount of of backups every day. So we have choice so we can recover from any particular point in time before the attack. We need to be able to recover without reinfection. How do we know we can recover without reinfection? Well, if we have no tools, no visibility that can show us the infection point, the infection type, and the blast radius, then there's only really one way, and that is to recover something we hope is okay, test it. If it wasn't, delete it, recover something else from another point in time. And how are you even going to know with certainty if you got infected there or you didn't? We need to recover obviously both Active Directory and Entra IDE as most are in hybrid mode today. Active Directory is synchronizing to Entra IDE. That makes it particularly complex. But also recovering a forest is complex. I'll talk about that in a bit. And, yeah, this is actually it. To recover a forest consistently is quite complicated. If you look at this Microsoft best practice forest recovery procedure, you can see this list is is quite extensive. And each of the items on the list is an additional sub menu of of additional things you have to do. So each domain is easily 20 steps. If you have multiple domains, you can just multiply with 20 per domain and then of course the recovery of the forest in itself. To say the least, a forest recovery is very complicated. You certainly want to make sure that you have tested a forest recovery in a time of peace and quiet, where you have you have your head with you and you don't have time against you. So go through a forest recovery practice because then you know what it takes when you really need it. This is what we are saying here at Rubrik. And we are actually giving you a tool so you can test this without actually destroying yeah. Essentially, testing it in a clean room environment. That's what you need. So with Rubrik, we now take the complexity of these multiple steps and we replace that with a simple five step forest recovery. It's an orchestrated workflow. You select a set of settings for your recovery, such as DNS and time zone and which environment you want to recover into and what type of recovery you want to to do. Of course, we can also do granular item recovery for AD, and we can also do a forest recovery for your intra oh, sorry. We can do an intra recovery for your intra, and we can also make a hybrid recovery of the AD and the intra being connected. So in today's guided click through lab, you'll experience what it looks like to make a complete forest recovery with Rubrik. And this tool is then available for you if you wish to, to use it. If you want to buy that product, obviously, then you can use it, to practice so you know what to do when when you need it. We also have an 80 object comparison function. That's actually in that that's the early version of the identity resilience. We will be bringing an identity resilience Cambro brake lab eventually, but for now it's it's identity recovery. But at least you can see how the comparison of of objects works in in that product. Hybrid recovery, already mentioned it. We understand both AD, forest, and entra, so we know the whole picture. So we can recover whether you are in one place or the other on a hybrid setup. So in total, what used to be something that could be taken offline, now you have Rubrik. It's immutable. It's air gap. It's zero trust. We will be here even in a case of ransomware attack. And, of course, we also have the Rubrik ransomware response team that is assisting customers that that get hit. This is a service free of charge, a Rubrik available to all Rubrik customers. What used to be a complex set of things you need to set in motion is now simple with an orchestrated workflow. Now you have a single platform, much simpler, much easier, and higher security. And what used to be limited with regards to AD, Forest and Entra is now seamlessly built into the same products. Those were the slides. And now, let's get ready for the click through lab demos. For now, if you have any questions, feel free. I can see there are already a number of questions. Let's see if I can answer them right away. Yes. Mark Sanders. Correct. Identity is more than just identity. It also includes DNS, DHCP, and certificates services. Active Directory file synchronization. Yes. So to break it down in in smaller components, the identity recovery product from Rubrik recovers your DNS and your d h well, not your DHCP. DHCP, you can protect just like you protect most other virtual servers if it is running in a virtual server. If it's if it's an appliance, then, of course, you need to take special care about that. But in short, we can recover the entire set of the things that are built into Active Directory, and that could be DNS and DHCP and time service as well. Hope that answers your question. And when you see the the actual lab, you'll see you'll you'll have much of these questions answered for you. Fahan, would you require an ID an AD admin or backup admin to typically use this tool to recover. You don't need to be an AD admin to use this tool, but you do need to have at the point in time when you need to do your AD recovery. You need the AD administrator password. So that can that persona can then sit next to you and assist that recovery. Caleb is asking what are the prerequisites for performing a bare metal for recovery. It's actually quite straightforward. For a bare metal recovery, you need rubric, obviously. You need to make backups of your domains and your forest. When you need to do the recovery, then you will select a BMR or bare metal recovery type. The only thing you require at that point in time is an ISO. So that's an official Windows ISO with the same version of the domain controller you are recovering. So just an ISO, and then it will be a guided workflow. So, Dik is asking, basically, is the idea about recovering identities and the service and applications that are associated with it. Yes. That is the, the basic idea. Active Directory and Forests as well as Entra ID as well as Okta. In short, the identity provider platform. Alright. I think it's now time to share the the link to the guided lab. Yeah. I pinned it. So I shared it in the chat, and, it's pinned, just above. So just, gives us a thumbs up if you are able to access it, if you received the link. Should be open to everyone. Yes. I see it at least. Let me know if you can access. Thank you. So it seems like it's working. Very good. Alright. I will jump off stage then and leave you to the guided lab. I think we still have two question more, David and Supriya. Okay. Can go. for a queue. I can see that. in. David is asking, is BMI using this feature still dependent on using PE, or do you have a more proprietary utility now? So we just need the ISO, the the official Windows ISO. That's all you need. So we don't need the PE. Hope that helps. Perhaps I can show you in the lab how it works, because it's not part of the guided lab. Let me see if I can spin that up for you. I don't see the other question, Francesco. Is the entry recovery feature included in Rubrik Complete Edition? Yes. This is a specific identity recovery edition that you need to purchase. It is licensed per user, either in AD or in the, in Entra. I don't know if the session is recorded. We might have the recording, but I think they can write to me here to get access after the session. There it is. Yeah. And David asks, general volume level recovery has required Windows PE. Does this signal a general move away from that then? I would say no. It does not signal a a a move away from PE for for standard, bare metal recovery. But for it might. I'm actually not part of, product management, so I don't know what their thinking are. You could argue that it would be a logical step because now we can do it without Windows PE. So it might. I simply I don't have the visibility into that. David is asking if the link will work after the session. Yes. It will. You can share it with Rubrik peers at work if you wish. I guess they will be missing, the presentation from me, but, they I guess they will quickly understand what it is about. So go ahead. Okay. Amazing. Like, it seems like everyone got access to the labs. David asking, the demo has no mention of the rubric agent. It's not needed for this exercise in real life. Well, actually, the rubric backup service or the rubric agent is required. You need to deploy it on the domain controllers in order to to back them up consistently with AD. And it does need to have backup admin permissions on the DCs. So all of that is thought of to have been deployed already before the lab. Hope that makes sense. So I think I should be able to share another screen now. So now you see the Rubrik Security Cloud, my demo environment. Yep. So if I go to inventory identity, we see now intra. We see active directory and forest and Okta. If we go to active directory, yeah, the forest I have. I have two forests. One is just a simple forest, simple domain, single domain. The other is a forest with one root and a couple of child domains. When I need to recover forests, this is the workflow. I select my forest and I click recover forest. This is the things we need to go through then. I'll just quickly select the latest, and I'll select to an alternate Windows host. Yeah. We are going through DNS, and we're also going through Windows time settings and the global catalog and the Kerberos ticketing password, all these things. And then finally, I'm configuring my recovery. In this case, I'm only recovering one DC. I could also be recovering one DC and then promote some hosts, which has proven to be the fastest way of recovering an entire domain. Instead of recovering all hosts, just recover one and then promote the following. You can also see here the recovery method is system state. If I click here, I am able to select bare metal recovery. And it actually does say, we should have a WinRE image, and that's the ISO I mentioned. So the official Windows ISO, the install ISO, you you boot on it, and then you drop drop into Windows recovery environment. So all native Microsoft Windows ISO. Hope that clears up any any questions you might have around that. We have two math methods. One is spare metal and the other is system state. System state does require that you have a running Windows with the same specific version as the DC you're recovering, and it has to have the same patch level. And there are some other requirements, such as, PowerShell and c plus plus and other packages that need to be deployed. And then it is not as fast as the bare metal recovery. So I do recommend the bare metal recovery. Right. Back to the session. Let's see. Do we have more questions? David is commenting. I think we had to add the rubric object to a d for some reason. Not sure what that what you mean with it. Can you elaborate? Danny is writing 99% of companies don't even backup entry ID. That is correct. And that is a massive massive gap, I think, today. Simon is asking, when will server twenty twenty five eighty backup be supported? Super good question. I'm not updated on that, but I will take a note and hopefully, I can get back and answer that before this session is is over today. I know we've been waiting for that for a while. Simon, are you running twenty twenty five active directory? Just out of curiosity. You are. Okay. Thanks for that. David, is clarifying for context as I joined slightly late. Is this a feature that will be added to RSC in the future? Well, this is very much a feature that is in our RC today, but it is an additional license you need to purchase. It's called identity recovery, and it is also available in an upgraded edition, if you will, called identity resilience. So identity recovery or identity resilience is what you need to purchase to have this functionality. David. I am comments. He means the computer object before you can back up AD. Yes. You do need to have that in your RC. How about complete hypervisor restore and recovery? Well, we've had hypervisor restore and recovery for a long time, Sadiq. So I think that should be covered. Containers in Kubernetes recovery, that is also in the product. We support multiple types of Kubernetes, both on prem and in the cloud. So that's covered as well. So the license you need for identity resilience is simply a user based license called identity sorry, identity recovery. I can yeah. It's it's it's pretty straightforward. Yeah. Just need identity recovery for x amount of users in your AD slash entry ID. Alright. Many good questions. I appreciate it. I prefer to have interactive sessions. But for now, I think I will jump off stage. And Alan asks if it's included in the enterprise license. Yeah. We would love for that to be the case, but that is not the case. It is an additional license. Enterprise is about giving you resilience with regards to ransomware attacks, the visibility into what has been attacked and when, and where are the the malware. And also, license is about your data security posture management, DSPM, to be able to identify where your sensitive data might be located. But there is a there is a connection from enterprise to identity resilience as it will now map user accounts into sensitive data. So now you can see which users, which personas, and which groups now have access to sensitive data. So that's a that's a step up in your cybersecurity. I don't think we have a recorded version of Camp Rubrik identity recovery. Do you know, Francesco? No. We don't have, we don't have anything recorded as if I that is available. We are able to deploy some labs for people who might want to to get it more hands on. Another thing that we can do is to organize a session where we are deploying those labs, but it's not something we are running continuously, like, on a on a schedule, like, the other camps because of the nature and the experience that it's better suited for a in person experience because there is a, like, a lot of time to wait while they during the recovery process. So that's why. And also, I guess, part of Camp Rubrik, the the the whole thought about it is that it's an interactive session. And as such, having a recorded session of someone else talking may not have a great value, at least not, in my opinion. I prefer to be present live. Ravi Rabitithya is asking whether you are getting a certificate. No. This is more like a seminar to to show you where we are, how it works today. We have something called Rubrik University. This is where you will get actual online training and certificates of the training you have completed. KS writes story lane is pretty cool. Well, thank you for that. That's really nice to to hear good feedback. Thank you. We appreciate it. It is it is with twisted hearts that we run the story lane because we prefer to show you the actual product. But in this particular use case, the story lane is actually better than the actual product. Also, So are too many, like, because of with these workshops, we are talking in the dozens or hundreds of people. While for the hands on labs, we have a much more limited capacity. So sessions must need a like, with a smaller like, a smaller dimension. So they wouldn't be so easy to scale the you know, with the with numbers and give access to everyone in a in a short period of time. Sasha is writing. She's hearing a loud piano sound, and someone gave her a thumbs up. I don't hear a loud piano sound. Do you, Francesco? No. Me neither. Anyone else hearing a loud piano sound? More thumbs up, please. No? Well so apparently, it's only you, Sasha, and one other person. Sorry about that, but I have no idea where it's coming from. There's some more replies here. I had this, had to exit and rejoin from Nick. So try to exit and rejoin. Maybe that will help, hopefully. Danny Maloney. Yes. I would love to come to take Cape Town and and show you this in in person. Is that a formal invitation? Because you consider it a done deal. Yeah. And, David, I agree. It's good to have a recording of the session you can share with your your colleagues. But even better, you can you can you can tap them gently on the shoulders and ask them to attend the next Cambrew Rig identity recovery. And then they at again, at some point, it will be identity resilience as well. The Daventa is writing there was about $30 per user cost difference for the products. The best way to justify this to your leadership is that it is actually bolstering your your your security posture. So identity recovery gives you something you don't have today, which is a consistent, easy, orchestrated workflow of recovering a forest. Something you you don't have today, most likely, I think it's it's worth it's it's money worth well spent. Identity resilience is about giving you a warning before the attack is is going to unfold. I guess that has a a big value as well. But, of course, would love to speak to you and and your leadership and and give you the arguments that you need to persuade them that it's it's actually a good idea. Our customers are really happy about the identity resilience product. And, well, as a person who's been with Rubrik for a long time, almost nine years, I've been through a lot of different products with Rubrik. And this is the fastest growing product we ever launched, identity resilience. It is it's very important for our customers. It's very popular. I guess that speaks for itself. KS writes, is there a way to recover to a clean OS to mitigate persistence from OS based compromise? Well, yes, there is. That's part of the enterprise edition where we are showing you let me show you here. I'll share my I'm showing you Rubrik Security Cloud again. Hopefully, you see it. So I'll show you what it's all about, the enterprise edition. So now well, first of all, I have data protection. That's the that's the main dashboard. The other one I already showed you is identity resilience. This is why we are looking at violations and misconfigurations and and, activities. But, ransomware, that is under data threat analytics. Here we are able to see and show you. First of all, active threats. Remember this slide I showed you originally this one. Going back. This one. Remember I talked about cyber integrations and you can see Mandiant. Mandiant is the biggest collection of malware or indicators of compromise, actual malicious binaries known in this planet. It contains 1,600,000 types of of indicators of compromise. It's constantly updated as the world community is getting to know more new ransomware strains. And every time someone detects that and updates the Mandiant database, Rubrik customers will have the benefit of being able to scan all their backups, not just current, but also historic against this known database of indicators of compromise. So, if we see one of those 1,600,000 known threat actors, we will alert you. And you will see this here as part of the threat monitoring. So it will show you if if you have one of these. And then we can also show you anomalies. An anomaly is an encryption event. This is after the payload has been detonated, but still for the victim getting hit by ransomware, the first thing you need to answer is what was affected, when was it affected, which systems, And which files? And we can show you all this in our data threat analytics dashboard. This is why enterprise edition is very much relevant for you. So hope that answers your question. Going back to this one here. Right. And back to the q and a. Hope you were able to rejoin, Sacha. Daniel. Danny writes: resilience is not about avoiding the storm, but learning to dance in the rain. Funny comment and not entirely wrong, I I would say. Oh, sorry. David Devender writes, it does. The current restore method is tedious and long. Yes. It is. How easy is it to do a Doctor scenario of a hybrid environment with Rubrik? Oh, a hybrid recovery, that's a big thing. So in short, what you have to do is the following. First, recover your AD Forest, then your recover your, Entra Connect server, reestablish synchronization, synchronize all the IDs from AD Forest back into ENTRE. Once that's complete, then you need to recover your identities in ENTRE with the missing components from AD Forest. So it's a multistep process. We are working on putting this all in one workflow. It's not simple at all, But at least we have everything covered from a d forest and intra in the same interface. So that still is a massive relievance of of complexity. And Sasha is back in. Good. Hopefully, piano is is gone. Nicholas writes, does object level recovery still not include GPO, partition recovery, and DNS records? GPOs, they are covered today. That's part of identity resilience. Partition recovery, that's a tricky bit. That's a tricky one. DNS records, I believe it's actually a nine five one DNS records. I believe it's in. Let me double check that. But partition recovery, not sure where we are with that actually. We are recovering the entire image with BMR. So we get all the bits in, but sometimes the boot order is needs to be fixed manually at boot time. But that's a simple thing. You just log in at boot, change the boot order, and then you're good to go. DNS records. Well and and, obviously, DNS records can only be recovered if they are inside AD. Right? But let me let me verify that. David asks, are you able to use this new feature to do test restores on prem using all from a tested environment into an isolated yes. You can certainly recover with this method into an isolated network. You have to build that network yourself. We are working on placing identity recovery under the umbrella of of this one here, data no. Orchestrated recovery. This is also part of the enterprise edition. Orchestrated recovery is about creating a workflow, an automated workflow for recovering multiple objects as one combined application, if you will, including pre and post scripts and checks and network settings and also to be tested in recovery environments. So identity recovery will be part of orchestrated recovery. We are actually building it in. It's not ready yet. It will be eventually. What you can see we covered today for orchestrated recovery is vSphere, AHV, or Acropolis, or, what's it called? Azure VMs, we have an AWS EC two. I mean, of course, Nutanix Acropolis. Oh, you don't see that? Am I not sharing? I'm sharing the wrong slide. Sorry about that. Goddamn it. There is here is orchestrated recovery. Okay. I hope I pronounced that somewhat correctly, asks, hi. Would we need to work with Inform Microsoft when performing full intra AD intra ID recovery? Massively good question. We can recover a full well, AD and Forest. We got this. Done. Checkbox. Entra, a bit more complicated. Let's assume you still have your Entra, but pretty much it screwed up everything. What you select is then a full Entra ID recovery, and I'll show you how that looks. Go to, identity resilience. Go to the tenant we have. Go to enter ID. Select the point in time. Select the snapshot. Select recover, and there you have full recovery. Now that does not mean your entire Entra. That means full recovery of the objects in Entra that we support. And what are those? You see under granular recovery. Hopefully, you see my yeah. You do. Under Entra, we support users, groups, roles, enterprise apps, app registrations, conditional access policies, named locations, authentication strength, and administrative units, as well as one more thing, which is visible here. No. That's the attributes. Oh, it's another demo environment. We have devices and keys already, but not in this environment here. It's another one. So that's what we support. So when we talk about a full enter recovery, we assume you still have control of your intra, and then we can recover these things in the in the dialogue of full recovery. The rest, you need to recreate yourself. And that's pretty much as far as as anybody has has gone on Intra. Now assuming that you have lost access to your Intra, and that is actually a that is a a possible scenario. In that case, you have to contact Microsoft, and they have to give you your entry back. Or you need to get a new entry. You need to create a new entry, And then very soon, Rubrik will be able to recover from an existing entra into a new one. That's a functionality we are calling cross entra recovery. We expect it will be here in the first half of this year. Actually, I think it's going to be the first quarter of this year. So that's cross intra recovery. That was a very long answer, but it's complicated. So thanks for that question. David writes, yes. I've seen boot order change with Rubrik, Windows Power p e, BMR for volume workloads. Yes. That's still something we are plagued with. We don't have the root cause of why. But, again, it's a simple thing to capture it during boot, change the boot order, and you are you're done. Daniel writes, do you have any remarks on dependencies? Entry ID is also used to log in to Rubrik. I would strongly recommend against using Entra to govern access to Rubrik Security Cloud. You see the problem. Right? You actually you you're thinking about that. Don't do that. Or at the very least, make sure you have a break class account into Rubrik Security Cloud so you can always gain access. David writes, sorry when I typed. Oh, I meant orchestrated recovery. Yes. Of course. Yeah. Orchestrated recovery. Yes. It will be part of orchestrated recovery. So, Thig writes, does it also support restoring backups from network including network convergence? Sadik, can you elaborate a bit on that question? Like, net bang up? You got me here. Let me see if I can identify what what the meaning of that question is or you can elaborate. Busy group today. I appreciate it. We had over 40 questions answered already, Salvador. So that's kudos to you. Good as to you guys. Thanks for keeping me busy. There is sound, Sadiq. I'm just trying to figure out how to respond to your question. Or maybe, Sadiq, if you want, I think you can also come on stage, like, you and you just have to click on or raise your hand. There is a function. It should be on the left panel, then you can come, on stage. yeah. In in short, what I gather from your question is restoring over the network in large amounts of data is complicated and tricky. And, ICVM and NetBackup are able to balance, network packages as part of massive restores. We are not, in particular, talking about network convergence with Rubrik because we have a different architecture that you may know. The Rubrik architecture is we have a scale out backup and recovery cluster of independent nodes. All of these nodes have both, data, backup server, storage, network, CPU, and compute. And all the nodes are distributing all the workload fully automated between them. So, your massive large scale network is going to come from lot of different nodes simultaneously, and they will balance how fast or well, they will balance the performance of the restore depending on your network and your client receiving, in essence, the throughput. We generally do not have to work with this as it tends to balance itself by the design of our massive cluster architecture of scale. I think that's that's my best answer I can give you at the moment. Yeah. Alan, you can absolutely jump off and and join the demo later. It will be available throughout the end of the day. Lewis writes, I did the demo AD recovery, and it took two and a half hours to recover AD on a controlled environment. Oh, yes. I have customers who have done this in their domains. I have assisted multiple customers doing AD and forest resource. And our practice and our experience in general shows us that it it takes between two to four hours for complete forest recovery. Yes. I've done multiple of those in in custom environments. Sadiq writes, is there a chance that the immutable copy can get corrupted? Now talk about chance and infinite infinity and infinite time and the universe. Yes, there is a chance. Is it something that's realistic in the lifespan of of your time with Rubrik? Not likely. Not at all. Are we subject to computer box like everybody else? Yes. We are. So it's not it's not 100% impossible, but it's very close. The whole immutability thing that we actually introduced into the world of backup and recovery. Yes. We did. All our all the other backup vendors in this in this world, they have adopted immutability. And don't get me wrong. That is a good thing. I am I'm I think it's it's better for the world to have immutable backup sets because it's so important. Now but we invented this, and and we were the first ones that did it. And we built it into our platform from day one when we built our new platform anyways. So it is my argumentation that we've done it better than anyone else. We really gave it a lot of thought. So the short answer to your question is no. There's no chance it can get corrupted. And the long answer you already heard, there is a theory theoretical possibility, obviously. However, it's it's tiny. I have never heard of of customers having their immutable backups. And by the way, all backups with Rubrik are immutable always. It is not a toggle. You cannot enable it or disable it. I have never heard anyone have a Rubrik backup penetrated. Never ever. Luis writes time from VM creation to working AD. Two hours. That's the time it takes from you start recovering your AD Forest until it is up and running completely. With the first domain controller, then you need to start promoting the following. Mark writes, thanks. I have to leave. Looking forward to recording. I think Francesco will have to record one. I can only say from my part, that I get recorded, I will probably fuck it up a lot more than I used to. But yeah. Let let's let's think about it. Danny writes, Beam appears to be more of a marketing driven solution. Well, no comments there, but we certainly have marketing with Rubik as well. We certainly do. Hi. Marketing. So it's, Francesco's marketing, but, you know, he's very quiet for marketing. Sadiq says, let's say there's only one chance. From the time to start recovering to the time to the recovery's completed, how do you define the space and metric? Well, that's the two to four hours. Yeah. Alright. At the bottom of the of the questions. Again, let's see if if more comes in. I will take a short break, and I'll be back in in, ten minutes. But don't forget your labs and your click through demos. That's that's why you're here. More questions. Ah. David writes, why did you decide to avoid tape and warm media as an archive target given that immutability is part of your key basic architecture? Super good question. Super good. The thing is with tapes, they are actually well, I would not say they are immutable. I would say they are inactive. You take the tape out of the tape drive, it's inactive. Right? Nothing can tamper with that tape as long as nobody has access to it. We're seeing problems with tape. The thing is people are losing tapes. They are dropping them. Many companies are depending on tape handlers. I mean, they are truck drivers. Nothing bad about truck drivers, But they tend to drop tapes here and there. Now, if if you can avoid that, making sure your tapes are safe, you know where they are, you know what's on them. They will decay over time as a magnetic media. You will have to eventually copy your tape. And you have to get it into a tape drive again, then read all of it sequentially because they're very bad at random access. They're very good at sequential. It will take a long time. How can you know that nothing was changed on your magnetic media? Now you're talking about CRC and checksums and all that. It's just a complicated media to work with. It is inactive, yes, but it is not immutable. Because if someone tampered with your tape drive and you stuck your tape in your tape drive, it could be overwritten just as well as a rotating disc media. So tape is not the solution to immutability in my opinion. Danny writes, thanks for the session, guys. See you in the next one. Looking forward to that, Danny. Companies still do sell tapes. I absolutely agree. Yes. They do. And I can tell you the biggest tape handler in the world is a company called IronVault. IronVault in in The US. You know what? IronVault is a Rupeg customer. I will say no more. Well, again, if if you get access to the tapes, Sadiq, you can easily destroy them. So in my opinion, having your backups in two separate locations under immutability is a better answer than tapes. I agree tapes is is low cost per terabyte, but, they're complicated. And then, of course, you need your tape drivers to be firmware updated and maintained. So yeah. Yeah. 321. I totally agree with you, Danny. 32110. Yeah. Totally agree. Okay. Now I will take that break that I announced. I'll be back in ten. Okay. So we are here just about to close the session for today with, like, an incredible number of questions. And thank you, Salvator, to pick them all. Obviously, if you have additional questions, you can always reach out to us. I think I wrote my email to several people who were asking about having a presentation or a recording. I will get back to you on that. Or if you need additional material, you can write to me or to Salvatoran. Or if you are a customer already and you have a contact internally, you are more than welcome to reach out to your contact person. That said, Salvator, I thank you again so much for your, like, for your support for the session today. I'm also sharing another link, which is this one. Let me drop it in the And as I wrote in the chat, I looked it up an active directory 2024. We are planning to release support for it this month. I found a document stating January 21 with CDM nine four three. Let's see if we make that or it will be delayed a bit, but that's the current plan. Amazing. And I hear I'm writing. I just typed today our page to register in case you want to take a a different type of experience or you want to repeat this workshop at a later stage, you want to send the link to some of your colleagues, feel free to register. That's where, like, you can see the calendar of our upcoming upcoming camps. And we hope to see you very soon again online or to be in touch as well very soon to answer additional questions. So thank you again, Salvatorre. Thank you, everyone, for attending to this session, and, we look forward to be in touch soon again. Thank you all. Have a wonderful day. See you in the future Cambrooke break. Bye. Thank you.