Providing a secure communication channel during active directory disaster recovery

A method for establishing a secure connection between a recovery console executing on a client and a recovery agent executing on a server, the method comprising:

• sending, by the recovery console, a console certificate to the recovery agent;
• storing, by the recovery agent, the console certificate to enable the recovery agent to access the console certificate during subsequent attempts to establish a secure connection with the recovery agent;
• installing, by the recovery agent, a hook on a first function that is called by a server-side security support provider to accept a certificate context received from a client;
• requesting, by the recovery console, that a client-side security support provider establish a secure connection between the recovery console and the recovery agent thereby causing the client-side security support provider to send a security token containing a console certificate context to the server-side security support provider;
• in response to the server-side security support provider receiving the security token and calling the first function, intercepting, by the recovery agent, the call to thereby obtain access to the security token;
• accessing, by the recovery agent, the stored console certificate received from the recovery console;
• and
• verifying, by the recovery agent, the console certificate context obtained from the security token against the stored console certificate.

One or more non-transitory computer storage media storing computer executable instructions which implement a method for establishing a secure channel, the method comprising:

• receiving, by a recovery agent executing on a domain controller, a console certificate from a recovery console executing on a client;
• storing the console certificate on the domain controller to enable the recovery agent to access the console certificate during subsequent attempts to establish a secure connection with the recovery agent;
• installing a hook on a function that is called by a security support provider to accept a certificate context received from a client;
• intercepting a call to the function that is made as part of a particular client's attempt to establish a secure connection with the recovery agent;
• and
• as part of intercepting the call, verifying a certificate context obtained from the intercepted call against the console certificate that was previously received from the recovery console and stored, wherein when the certificate context is verified, the recovery agent allows the intercepted call to complete, whereas when the certificate context is not verified, the recovery agent causes the intercepted call to fail.