Why Ransomware Recovery Starts with Active Directory

After a ransomware attack, the instinct is to restore the systems the business notices first: email, the ERP, the file shares. But almost all of them depend on one thing that has to come back before them. Until Active Directory and Entra ID are trustworthy again, people can't sign in, and restored applications and data can't be used safely.

According to a Dark Reading estimate cited by Commvault, nine in ten cyberattacks involve Active Directory. Attackers use it to move around, raise their privileges and lock defenders out.

What to protect

• Active Directory: users, groups, group policy objects and the relationships between them, recoverable down to a single object or attribute.
• Entra ID: users, groups, roles, conditional access policies and app registrations, so deleted or modified objects can be restored and access comes back.

Two kinds of recovery

Object restore rolls back the individual users, groups, policies or attributes that were deleted or changed, so only what broke is touched. It's the everyday case: a deleted security group, a bad bulk change.

Forest recovery rebuilds Active Directory itself, domain controller by domain controller, when the whole directory is compromised. Done by hand, it can run to 50–100 or more tasks and take days to weeks.

A forest recovery, in order

1. Declare and contain. Isolate affected systems and agree who leads the recovery.
2. Find a known-clean point. Compare the directory between two points in time and choose the last backup taken before the attack.
3. Pick the restore order, usually one domain controller per domain first.
4. Restore the first domain controllers from the clean backup, isolated from the compromised network.
5. Run the consistency tasks: seize FSMO roles and adjust the RID pool, as Microsoft's forest recovery guidance describes.
6. Rebuild the rest of the domain controllers.
7. Reset privileged credentials, including the KRBTGT account, before anyone signs in again.
8. Restore Entra ID and validate that people can sign in before applications come back.

Practice before you need it

The best time to run a forest recovery is in a non-production lab, long before an attacker forces you to. KELYN plans and runs those tests with you, and Identity Recovery handles the work from a single deleted group to a full forest rebuild.

Our Active Directory and Entra ID recovery guide has the full runbook outline and readiness checks, as a web page and a PDF.