How the Active Directory Recovery Agent works