An accounting firm's Active Directory, rebuilt and re-tiered after ransomware reached the domain admins
An accounting and advisory firm of about 400 people in four U.S. offices.
- Scale
- ~400 users, 6 domain controllers, 4 sites, 1 forest
- Engagement
- 11 days from the first call to a verified domain; hardening over the following 8 weeks
The challenge
Ransomware had encrypted file servers and a domain admin credential was in the attacker's hands. The firm's only backups of the directory were on the same network, and nobody knew whether they were clean.
What our team delivered
- Containment first: affected segments isolated, domain admin and service accounts disabled, and memory and logs preserved from domain controllers before any rebuild
- Scoping the intrusion from event logs and directory replication metadata to find what was changed: new accounts, group membership, delegation, Group Policy objects and scheduled tasks
- Recovery to a known clean point: domain controllers rebuilt from the operating system up, and the directory restored from a system-state backup that predated the intrusion
- Double reset of the krbtgt account, with a replication wait between resets, to invalidate forged Kerberos tickets; all privileged and service credentials rotated
- Tiered administration afterwards: separate admin accounts per tier, Protected Users, Local Administrator Password Solution on every workstation and server, and group managed service accounts for services
- Backups moved to an immutable copy with a separate identity, plus a written forest recovery runbook that was rehearsed once
Result
Mail, files and line-of-business systems returned in priority order, each verified before rejoining the network. The firm now has a documented forest recovery procedure and a directory in which one stolen password no longer reaches everything.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Backup tiers: data lost versus time to recover
Recovery point objective (RPO) is how much recent data a restore loses; recovery time objective (RTO) is how long the restore takes. Faster tiers sit close to the production system and share its fate; slower tiers survive ransomware and site loss. The scale is logarithmic. Illustrative figures.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.