recovering-from-ransomware-attack

Recover from ransomware by first completing containment and forensic preservation, then building an isolated recovery environment. Restore Active Directory first from verified pre-compromise backups, reset the krbtgt password twice, then restore remaining systems in dependency order with continuous EDR monitoring.

Reset the krbtgt account password twice with approximately 12 hours between resets to allow replication, which invalidates all Kerberos tickets and defeats Golden Ticket persistence. Confirm replication completed with repadmin /showrepl between the two resets, then reset all privileged account passwords.

Restore systems in dependency order: identity infrastructure (domain controllers, DNS, DHCP) first, then critical business systems like databases and ERP, followed by file servers and email, and finally development and archive systems. Restoring application servers before AD breaks authentication and wastes recovery time.

Mount backups read-only and scan them with antivirus such as ClamAV, then search for ransomware artifacts like encrypted file extensions and ransom notes. Confirm the backup timestamp predates the earliest known compromise, since attackers often dwell in networks for weeks before detonating encryption.

Do not begin recovery before containment is complete and forensic scoping has identified the attacker's access and persistence mechanisms. Premature recovery without clearing scheduled tasks, services, run keys, and WMI subscriptions risks immediate re-infection of restored systems.