Disaster Recovery Runbook

Level 1 — Single Application

One application is down, everything else works

Dental software corrupted, database locked, application won't launch after failed update

1–2 hours

Level 2 — Single Server

Server is down but network and workstations function

Server hardware failure, OS won't boot, failed Windows Update, VM corruption

2–4 hours

Level 3 — Infrastructure

Multiple systems down, network may be affected

Core switch failure, firewall failure, power event + UPS failure

2–6 hours

Level 4 — Total Loss

Everything is gone. Hardware destroyed or compromised.

Ransomware (encrypted everything), fire/flood, lightning strike, theft

4–24 hours

1

Notify your manager / T3 lead immediately.

Don't try to handle Level 2+ alone.

☐

2

Open a Priority 1 HALO ticket.

Include: client name, what's down, when it happened, what you know so far.

☐

3

Notify the client.

Be honest about what you know: "The server is down. We're working on recovery. I'll update you every 30 minutes." Give them a realistic timeframe, not a hopeful one. NOTE: If you say something like "I will update you every XX minutes" make sure you set a recurring alarm for yourself. Nothing is worse than committing something to a stressed client that you do not honor because you lost track of time.

☐

4

Assess what's still working.

Workstations? Internet? Phones? Email? Identify what the practice can still do while you recover.

☐

5

Identify the last known good backup.

Check Veeam for the most recent successful backup job. Note the timestamp.

☐

6

Do NOT make changes that could make it worse.

Don't format drives, don't reinstall Windows, don't delete anything until you have a recovery plan.

☐

1

Open Veeam Backup & Replication console

2

Navigate to Home → Backups → Disk (or wherever the backup job lives)

3

Right-click the most recent restore point →

Restore guest files

→

Microsoft Windows

4

Browse to the application directory (e.g.,

C:\PBSEndo\Client\

,

C:\Program Files\TDO\

)

5

Select the files/folders to restore

6

Choose

Overwrite

or

Keep both

depending on whether you want to replace or compare

7

Restore and verify the application launches

PBS Endo

C:\PBSEndo\Client\endoui.exe.config

, Updates folder

Config wipe is documented failure mode — see PBS Endo Config Wipe SOP

TDO

SQL database, TDO application files

Must restore server-side first, then update workstations to match

Dentrix

Data directory (check Dentrix server config for path)

May need re-registration with Henry Schein after restore: 800-824-6375

Eaglesoft

Data directory, Patterson server config

May need reactivation: Patterson 800-475-5036

Open Dental

MySQL data directory

Must stop MySQL service before restoring database files

CS Imaging 8

SQL database, CS Imaging service config

Verify SQL connectivity and CS Imaging service starts after restore

Sidexis 4

SQL database, Sidexis config files

Verify SQL connectivity and Sidexis server service starts after restore

EzDent-i

PostgreSQL database, EzServer config

Must stop PostgreSQL before restoring. Version-specific restore process.

1

Open Veeam Backup & Replication console on the Veeam server

2

Home → Backups → Disk → locate the server backup job

3

Right-click the most recent successful restore point →

Restore entire VM

4

Select restore destination: Original location (same host) or Different location

5

Choose whether to overwrite existing VM or create new

6

Start restore and monitor progress

7

Once complete: boot the VM, verify OS loads, check all services

1

Create Veeam Recovery Media (USB) from the Veeam console if not already created

2

Boot the target hardware from Veeam Recovery Media

3

Select

Bare Metal Recovery

4

Connect to Veeam backup repository (network path or direct-attached storage)

5

Select the server backup and restore point

6

Map disks (source disk layout → target disk layout)

7

Start restore and monitor progress

8

Once complete: remove recovery media, boot normally, verify all services

1

Open Veeam Backup & Replication console

2

Home → Backups → Disk → right-click server backup →

Instant VM Recovery

3

Select the restore point

4

Choose the Hyper-V or VMware host to run the VM on

5

Veeam boots the backup directly as a running VM (reads from backup files)

6

This is temporary

— performance is limited by backup storage speed

7

Use this to get the practice operational while you prepare permanent hardware

8

Migrate to permanent hardware using Storage vMotion or Veeam Quick Migration

1

Server boots and OS loads

☐

2

All server roles functional (AD, DNS, DHCP, File Server, Print Server)

☐

3

SQL Server running and databases accessible

☐

4

Dental software server services running

☐

5

Workstations can connect to the server (ping, share access, DNS resolution)

☐

6

Dental software launches on workstations and data is current

☐

7

Imaging works (if server-dependent imaging — test acquisition and retrieval)

☐

8

Printers working (if print server was on this server)

☐

9

Backup job reconfigured and running (Veeam may need to be re-pointed after restore)

☐

10

Remove VM checkpoint if one was used (don't leave checkpoints running long-term)

☐

11

Client notified that systems are restored and operational

☐

12

HALO ticket updated with full recovery timeline and actions taken

☐

1

Isolate ALL affected systems from network (pull cables, disable WiFi)

☐

2

DO NOT

power off systems (RAM forensics may be needed)

☐

3

DO NOT

pay the ransom

☐

4

Notify DTC management immediately — this may require cyber insurance claim

☐

5

Document everything: screenshots of ransom notes, encrypted file extensions, timeline

☐

6

Determine scope: which systems are encrypted? Are backups affected?

☐

7

Are Veeam backups intact? (If Veeam backup files are also encrypted → worst case)

☐

8

Are off-site / cloud backup copies available?

☐

9

Determine ransomware variant: check nomoreransom.org for known decryptors

☐

10

Plan clean rebuild: all affected systems must be wiped and rebuilt from scratch. Never trust a system that was compromised.

☐

1

Procure replacement hardware (or clean/wipe existing hardware)

Hours to days

2

Rebuild network infrastructure (firewall, switches, APs) from config backups or DTC templates

2–4 hours

3

Rebuild server: fresh OS install, rejoin/recreate domain

2–4 hours

4

Restore data from Veeam: database files, dental software data, shared files

2–6 hours

5

Reinstall dental software on server, point to restored database

1–3 hours

6

Rebuild workstations: follow New Workstation Deployment SOP for each

1–2 hours each

7

Reconfigure dental software on workstations

30 min each

8

Verify all systems operational

1–2 hours

9

Reconfigure Veeam backup to protect new environment

30 min

DTC Management / T3 Lead

Immediately for Level 2+

[Internal contact]

Client primary contact

After initial assessment — provide status and timeline

From HALO ticket

Microsoft Support

If M365/Entra/Exchange issues during recovery

800-642-7676

Veeam Support

If backup restore fails or backup files appear corrupted

614-339-8200

ISP

If internet circuit is down as part of the disaster

Client-specific (check HALO/documentation)

Dental software vendor

If application won't start after data restore (licensing, activation)

See Vendor Escalation Quick Reference

Cyber insurance provider

Ransomware or data breach confirmed

Client's policy (check with client/AM)

Server (PMS down)

See patients using paper charts, collect copays manually, reschedule non-urgent

Imaging only

See patients for non-imaging procedures, take impressions, do cleanings

Internet only

Use PMS and imaging (they're local), no insurance verification or claim submission

Everything

Triage: see emergency patients only, handwrite notes, collect payment manually, call patients directly to reschedule

What happened? (Root cause)

Exact failure — hardware, software, human error, security incident

When did it happen?

Timeline from first symptom to full recovery

How long was the practice down?

Total downtime in hours

What was the recovery path?

Which Veeam method was used, what was the restore point date/time

Was any data lost?

Gap between last backup and failure = data loss window

What worked well in the recovery?

—

What should be improved?

Backup frequency? Off-site copy? Recovery media pre-staged? Documentation gaps?

What preventive measures should be implemented?

UPS replacement, backup verification schedule, hardware refresh, security hardening

Veeam backup verification (job status check)

Daily (automated alerts), weekly (manual review)

T1/T2

Veeam test restore (actually restore a file and verify)

Monthly

T2

Veeam Recovery Media created and stored for each client

Annually or after server hardware change

T2

VM checkpoint cleanup (remove old checkpoints)

After every maintenance window

T2

UPS battery test

Quarterly

T2

Server hardware health check (SMART, RAID, temps)

Monthly via NinjaRMM alerts

T1

Off-site / cloud backup copy verified

Monthly

T2

Firewall config exported and stored

After every change

T2

DNS records documented

After every change

T2

Emergency contact list current in HALO

Quarterly

AM

Pre-Upgrade / Pre-Flight Checklist

Should have been run before any change that led to disaster

Veeam Backup Alert Response Guide

For understanding backup health before disaster strikes

New Workstation Deployment SOP

For rebuilding workstations after total loss

Network Assessment Guide & Checklist

For understanding client network architecture during infrastructure recovery

Vendor Escalation Quick Reference

For contacting dental software vendors during application recovery

M365 Tenant Administration Transition SOP

If M365 services are affected and need recovery

HALO Ticket Documentation Standard

For documenting the disaster and recovery in the ticket

1.0

February 2026

IT Support Engineering

Initial release. Four-level disaster classification, recovery decision trees, Veeam restore procedures (file-level, full VM, bare metal, instant VM recovery), infrastructure restoration priority order, ransomware response, post-disaster review template, preventive measures checklist.