You need to ensure that the rights account certificates issued in adatum.com are accepted by the AD RMS root cluster in contoso.com
You need to perform a bare-metal recovery of Server1 by using the Windows Recovery Environment (Windows RE)