Get everyone signed in again, before anything else.
After an attack, recovery starts with identity. KELYN protects Active Directory and Entra ID with Commvault, and runs the restore, from a single deleted group to a full AD forest rebuild.
How it works
From one bad change to a full forest rebuild.
Most identity incidents are a deleted object or a malicious policy change. The worst ones take out the whole directory. The same service covers both.
- 01
Protect
Automated, frequent backups of Active Directory and Entra ID: users, groups, roles, policies and the relationships between them.
- 02
Compare
See exactly what changed in a domain between two points in time, and restore straight from the comparison report.
- 03
Restore what broke
Recover individual objects or attributes, so only the damaged or misconfigured items are rolled back.
- 04
Rebuild the forest
When AD is compromised end to end, an automated, runbook-driven forest recovery brings domain controllers back in order.
Capabilities
What the platform does.
Automated forest recovery
Follows Microsoft's recommended approach, with runbooks that handle consistency tasks such as seizing FSMO roles and adjusting the RID pool.
Active Directory coverage
Users, groups, group policy objects and their relationships, recoverable down to a single object or attribute.
Entra ID coverage
Users, groups, roles, conditional access policies, app registrations and more, so deleted or modified objects can be restored and access comes back.
Topology and progress views
Visual topology shows which domain controllers to restore first; runbook views track progress and estimated time remaining.
Multi-DC restore
Restores multiple domain controllers per domain and promotes additional DCs to rebuild the pre-incident infrastructure.
Recovery testing
Run forest recovery in a non-production lab, so the process is proven before an attacker forces you to use it.
Why it matters
Identity is where attacks start, and where recovery stalls.
Managed service
Commvault protects the directory. KELYN runs the recovery.
Identity recovery is a sequence, not a button. Here's what each side covers.
| Area | Commvault platform | KELYN managed service |
|---|---|---|
| Backups | Automated, frequent backups of AD and Entra ID objects and attributes. | Sets up and monitors coverage for every domain and tenant, and checks that backups complete. |
| Change review | Comparison reports between two points in time, with restore from the report. | Reviews unexpected changes with your team and rolls back what shouldn't be there. |
| Recovery testing | Forest recovery in a non-production lab. | Plans and runs forest recovery tests, and documents the order and timing for your runbook. |
| During an incident | Runbook-driven forest recovery and object-level restore. | U.S.-based engineers run the identity recovery with you, so sign-ins work again before anything else comes back. |
FAQ
Common questions.
Almost everything else depends on it. Until Active Directory and Entra ID are trustworthy again, people can't sign in, and restored applications and data can't be used safely.
Object restore rolls back individual users, groups, policies or attributes that were deleted or changed. Forest recovery rebuilds Active Directory itself, domain controller by domain controller, when the whole directory is compromised.
Commvault describes manual AD recovery as taking days to weeks, with 50 to 100 or more tasks in a forest recovery. Automated runbooks remove most of that manual work.
Yes. Entra ID users, groups, roles, conditional access policies and app registrations are backed up, and deleted or modified objects can be restored.
Yes. Recovery can run in a non-production lab, and KELYN plans and runs those tests with you.
Know how long it would take to get your users back.
Talk to a KELYN engineer about your domains and tenants, your current backups, and what a tested forest recovery would look like for you.