According to this Veeam document, and implied by this Microsoft document, a restored (or cloned) DC will boot into DSRM, and there's no way to tell from the login screen. It does flash up briefly stating this is what's happening (even if you select "Start Windows Normally"), but you have to be quick to see it.

Logging in (successfully) with the DSRM password confirmed this was the case.

The Veeam article suggests opening a command prompt and running the following:

bcdedit /deletevalue safeboot
shutdown -t 01 -r

The MS article advises the same but doesn't give the commands.

Rebooting after this allowed a successful login with domain credentials.