Restore Evidence Check
Thirteen questions on whether you could actually restore the VCF 9.1 management plane, and which of your answers leave a gap you would only find on the night.
Runs entirely in your browser. Nothing you enter is sent anywhere.
Your estate
If the management plane were lost tonight
Answer yes only if you have tested it, not if it is in a design document. Not sure counts as a gap, because a backup nobody has restored from is a hope.
An SFTP server is provisioned for file-based backups
SDDC Manager, NSX Manager, vCenter, VCF Management Services, VCF Automation and Identity Broker back up to SFTP. Not SCP, not a file share, not object storage. Keep room on it for a full set: NSX can report a backup as successful while writing empty files to a full target (KB 459284).
A third-party image-based backup tool covers VCF Operations and VCF Operations for Networks
These two are image-based only, so they land in whatever your backup team already runs. Broadcom does not ship it.
The SDDC Manager credentials database is backed up separately through the credentials API
From 9.1.1 it is no longer included in the SDDC Manager backup. Not applicable on 9.1.0.
The backup target sits outside the failure domain of the management domain
Broadcom's recovery guidance assumes the backups survive the loss of any given site.
Workload domain VMs are backed up with your own tooling
Workload VMs are explicitly out of scope of the VCF instance recovery guidance, and they are the largest part of the estate.
Rebuilding the License Server is written into the recovery runbook
There is no backup method for the License Server. Recovery means deploying a new one and reconfiguring licensing.
Scheduled backups run, not only manual backups taken before a change
The VCF Automation services runtime and migration engine, telemetry and real-time metrics are captured only by a scheduled backup.
Log data is archived separately from the VCF Management Services backup
Log management configuration is in the file-based backup. The log data itself is not.
The VCF Operations backup is scheduled away from dynamic threshold calculations
Dynamic thresholds run at 2am by default, which is when many enterprise backup windows open.
VCF Operations cluster nodes are backed up together, with the cluster offline or without quiescing
All nodes at the same time. Take the cluster offline, or if you cannot, do not quiesce the file system.
An up-to-date configuration record is held on secure secondary storage
Topology diagrams, network mappings, IP addressing, DNS, NTP and vCenter settings. Mandatory for manual recovery.
Instance recovery prerequisites have been checked with Confirm-VCFInstanceRecoveryPreReqs
Windows Server 2022 or later, PowerShell 7.5.x or later, VMware OVF Tool, OpenSSL 1.0.2g or later on the PATH, PowerCLI, and Posh-SSH 3.0.8.
Change records describe the back-out plan as restore from backup, not rollback
There is no documented rollback for a VCF 9.1 upgrade. The only documented pre-upgrade snapshot covers the VCF Operations nodes.
What this is built on
- Restore is a rebuild. Broadcom's instance recovery guidance describes rebuilding a VCF instance from backup, not repairing one, for complete instance failure, ransomware and datastore corruption.
- Three backup methods, not one. Image-based, file-based over SFTP, and either. Two of them need infrastructure you have to provision first.
- Two components have no backup at all. The License Server, and from 9.1.1 the SDDC Manager credentials database inside the SDDC Manager backup.
- There is no rollback. The back-out plan for an upgrade is restore from backup.
Built from Broadcom documentation read on 5 November 2026 and re-checked on 7 November 2026, against VCF 9.1.1. Backup scope changes between point releases, and 9.1.1 already removed one component from a backup it used to be in. Check against the documentation for the build you are running.
Where this comes from
- What you have to be able to restore, the write-up behind every question here, with its own sources.
- Broadcom, VCF Component Backup and Restore design blueprint, for the backup methods, the SFTP prerequisite and the License Server.
- Broadcom, Component Backup and Restore of VMware Cloud Foundation, for what each component's backup includes and excludes.
- Broadcom KB 459284, NSX Manager reports backup success while writing 0-byte files when the SFTP server is full. Fix scheduled for NSX 9.2.
- Broadcom, VCF Instance Backup and Restore, for the rebuild model, the configuration record and the recovery module prerequisites.
- Broadcom, Create Snapshots of the VCF Operations Nodes Before You Upgrade, the only documented pre-upgrade snapshot.
What this tool cannot know
- Whether your backups actually restore. It takes your word, which is why the answer it wants is tested, not configured.
- Your recovery time. A rebuild of a whole instance is measured in days, and this tool does not estimate it.
- Anything about your backup product, its retention or its immutability, which matters a great deal against ransomware.
- Partner and add-on components on the management plane, which have their own backup requirements.
- What your regulator or auditor will accept as evidence. That is a conversation this gives you a starting point for.
Part of the VCF planning toolkit
The last of the set. The others work out whether you can move, when and in what order; this one asks whether you could come back if it went wrong.