A compromised Active Directory forces a bad choice. Restore quickly and risk carrying the attacker's changes back in, or wait hours for a clean full forest recovery.
Commvault's Active Directory Pre Recover is built to remove that choice. It keeps a continuously scanned standby copy of AD in an isolated, air-gapped Cleanroom, so organisations can fail over in minutes.
The offering combines two existing Commvault components, Cleanroom and Threat Scan. Commvault says the pairing can cut clean Active Directory recovery from hours to minutes. Identity underpins access to nearly every other system, which is why recovery speed and recovery cleanliness both matter.
Threat Scan inspects AD backups continuously so the standby copy stays free of malicious content. The copy sits ready for failover rather than waiting to be rebuilt.
The alternative approaches are a full forest recovery or identity synchronisation into a separate directory. Both take time and both introduce their own failure points.
With the standby copy in Cleanroom, applications can continue authenticating against trusted identity services. That removes the need to replicate accounts into alternate identity and access management systems, and removes the wait for a full forest restore to finish.
Commvault frames the result as maintaining trusted access to critical systems while production identity services are unavailable.
Cleanroom is the company's isolated recovery environment, used for testing restores and running production workloads away from a compromised estate. Threat Scan inspects backup data for malicious content.
Pairing the two is the point of the announcement. The company describes it as coupling recovery speed with recovery cleanliness, rather than trading one against the other.
"Identity is foundational to every enterprise application, user, and business process," said Rajiv Kottomtharayil, Chief Products Officer at Commvault.
"Commvault has already made significant progress reducing identity recovery times from weeks to hours, and now we are extending that progress toward near-real-time availability."
Availability and licensing
Active Directory Pre Recover will be available for early access in the coming months, delivered as part of Commvault's Identity Resilience portfolio.
All enterprise AD customers will receive it as part of their existing licence, including a lite version of Cleanroom. The offering will be available globally through Commvault's partner ecosystem.
Commvault says the announcement responds to identity systems becoming a primary target for attackers. Organisations also face increased pressure to restore rapidly and without risk of re-infection.
Where an attacker has held domain-level access, a restore returns whatever persistence was written into the directory before detection. The standby copy is intended to remove that step from the critical path.