An accounting firm's Active Directory, rebuilt and re-tiered after ransomware reached the domain admins
An accounting and advisory firm of about 400 people in four U.S. offices.
- Scale
- ~400 users, 6 domain controllers, 4 sites, 1 forest
- Engagement
- 11 days from the first call to a verified domain; hardening over the following 8 weeks
The challenge
Ransomware had encrypted file servers and a domain admin credential was in the attacker's hands. The firm's only backups of the directory were on the same network, and nobody knew whether they were clean.
What our team delivered
- Containment first: affected segments isolated, domain admin and service accounts disabled, and memory and logs preserved from domain controllers before any rebuild
- Scoping the intrusion from event logs and directory replication metadata to find what was changed: new accounts, group membership, delegation, Group Policy objects and scheduled tasks
- Recovery to a known clean point: domain controllers rebuilt from the operating system up, and the directory restored from a system-state backup that predated the intrusion
- Double reset of the krbtgt account, with a replication wait between resets, to invalidate forged Kerberos tickets; all privileged and service credentials rotated
- Tiered administration afterwards: separate admin accounts per tier, Protected Users, Local Administrator Password Solution on every workstation and server, and group managed service accounts for services
- Backups moved to an immutable copy with a separate identity, plus a written forest recovery runbook that was rehearsed once
Result
Mail, files and line-of-business systems returned in priority order, each verified before rejoining the network. The firm now has a documented forest recovery procedure and a directory in which one stolen password no longer reaches everything.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
$1,000 per assessment
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
$5,400 per bundle, phishing simulation for 25 users
Show 2 more
Active Directory health check
Find the misconfigurations that let an attacker go from one stolen password to full control of your domain.
$1,800 per domain
Microsoft Exchange emergency recovery
Mail is down or an Exchange server is compromised. We stabilize, restore and secure it.
$2,900 per incident
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Backup tiers: data lost versus time to recover
Recovery point objective (RPO) is how much recent data a restore loses; recovery time objective (RTO) is how long the restore takes. Faster tiers sit close to the production system and share its fate; slower tiers survive ransomware and site loss. The scale is logarithmic. Illustrative figures.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.