TL;DR: Ransomware recovery often fails first at identity, with more than 78% of human-operated attacks involving domain controller breaches and typical downtime measured in 22 days, according to Commvault. The practical lesson is that data recovery without clean AD and Entra ID restoration leaves organisations locked out of their own environment.
At a glance
What this is: This is a ransomware resilience analysis arguing that Active Directory and Entra ID are often the first systems to fail and must be restored cleanly before broader recovery can succeed.
Why it matters: It matters because IAM, PAM, and security operations teams cannot treat identity recovery as secondary when the control plane that authenticates users, systems, and trust relationships is what ransomware often destroys first.
By the numbers:
- More than 78% of human-operated ransomware attacks involve domain controller breaches.
- Average ransomware downtime is 22 days.
Context
Ransomware recovery fails quickly when identity services are part of the blast radius. Active Directory and Microsoft Entra ID are the systems that let organisations authenticate, authorise, and re-establish trust across the environment, so when they are damaged, even clean data is difficult to use.
The article frames that failure as a resilience problem rather than a pure backup problem. Clean identity restoration, immutable copies, and rehearsed forest recovery are what determine whether recovery is controlled or whether teams end up rebuilding trust chains under pressure.
Key questions
Q: What fails when ransomware reaches Active Directory or Entra ID?
A: When ransomware reaches identity infrastructure, the failure is not just encryption. Authentication, privilege administration, service access, and recovery coordination can all stop at once because they depend on the same trust layer. That is why identity compromise often becomes a full business outage rather than a contained technical incident. The control to watch is whether identity can be restored to a trusted state.
Q: Why do domain controller breaches make ransomware recovery so much worse?
A: Domain controllers are central trust brokers, so when attackers compromise them they can block access, manipulate authentication state, and force administrators into a much larger rebuild. The operational impact is longer downtime, more expensive recovery, and a higher chance that normal restore steps will simply reintroduce the compromise.
Q: What are the signs that a recovery program is not ready for a ransomware event?
A: A recovery program is not ready when teams have not practiced the runbook, roles are unclear, and approval delays slow action during a crisis. Other warning signs include untested backup validation, weak coordination across incident response, legal, communications, and insurance teams, and no rehearsed process for restoring from isolated copies without re infection.
Q: Should organisations prioritise identity restoration before data restoration after ransomware?
A: Yes, because identity is what makes restored data usable. If Active Directory or Entra ID remains untrusted, the organisation may recover files but still be unable to authenticate users, validate services, or re-establish access across systems. Identity recovery has to come first in the recovery sequence.
Technical breakdown
Why Active Directory and Entra ID are recovery dependencies
Active Directory and Entra ID are not just directories. They are the trust anchors that issue, validate, and propagate identity state across users, devices, services, and policy. When ransomware disables domain controllers, corrupts synchronization, or alters authentication policy, the organisation can still have data but lose the ability to prove who or what may access it. That creates a recovery bottleneck: storage may be intact, yet access remains broken until identity state is rebuilt from a clean source.
Practical implication: Treat identity services as part of the recovery critical path, not as a downstream restore step.
Why clean, immutable identity backups matter
A normal backup is not enough if it captures compromised identity state. For AD and Entra ID, the restore point must be clean, immutable, and isolated from the attack path, otherwise the organisation risks reintroducing tampered trust relationships, stale policy, or hidden persistence. That is why the article stresses air-gapped copies and validation before bring-up. In identity terms, restoration without trust verification simply replays the compromise into a fresh environment.
Practical implication: Validate identity backups as clean recovery artefacts before any domain or tenant rebuild begins.
Full-forest recovery as an identity reconstruction problem
Full-forest recovery is the rebuild of the identity control plane, not just a server recovery exercise. It must re-establish domain controllers, trust relationships, authentication policy, and cloud identity settings in the correct sequence so that access returns without cross-contamination. The important technical point is orchestration: recovery fails when teams restore components in isolation and assume the directory will naturally converge back to a trusted state. Identity recovery has to be deterministic, sequenced, and verified.
Practical implication: Use tested recovery runbooks that rebuild identity services in the same order the business depends on them.
Threat narrative
Attacker objective: The attacker aims to deny access, destroy trust, and force a recovery that is slow, expensive, and operationally chaotic.
- Entry typically begins with exposed credentials, weak authentication, or a flat network that gives ransomware operators a path into the identity layer.
- Credential access then targets domain controllers, trust relationships, or identity synchronisation components so the attacker can disable or manipulate the control plane.
- Escalation follows when the ransomware operation uses that identity foothold to lock out administrators, encrypt systems, and interrupt normal authentication and recovery workflows.
- Impact is organisational paralysis, because without trusted AD or Entra ID state, even clean data backups cannot be reliably accessed or reintroduced.
Breaches seen in the wild
- Storm-0501 hybrid cloud attacks 2024: Ransomware affiliate Storm-0501 stole Entra Connect Sync credentials to move from on-prem AD to Entra ID, then forged tokens via a rogue federated domain.
- Commvault Metallic breach 2025: A nation-state actor exploited a Commvault zero-day in Azure and may have taken app secrets that open customers' Microsoft 365 tenants.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity resilience is the real recovery control plane: ransomware recovery fails when organisations treat data restoration as the finish line. If Active Directory or Entra ID is compromised, authentication and authorisation cannot be re-established cleanly, so the business remains functionally locked out even when storage is available. The practitioner conclusion is simple: identity state has to be restored as deliberately as data state.
Clean identity recovery is a trust problem, not a backup checkbox: immutable copies only help if the restore point is verified as uncontaminated and isolated from the attack path. In an identity recovery scenario, replaying compromised trust relationships or policy state can recreate the breach conditions inside the rebuilt environment. The conclusion is that recovery validation must include identity integrity, not just file integrity.
Full-forest recovery exposes whether resilience is real or performative: many programmes can back up systems, but far fewer can rebuild the identity fabric in the right order under pressure. That is the difference between surviving a ransomware event and merely preserving evidence of one. The conclusion is that recovery drills must test the identity plane, not only the data plane.
Identity resilience for ransomware is now a business continuity requirement: the article's core message is that weeks of downtime and seven-figure loss are not exceptional outcomes when identity recovery is not engineered in advance. AD and Entra ID now sit in the same resilience tier as core infrastructure because they determine who can return to work, what can be trusted, and what can be restored. The conclusion is that identity recovery maturity is a board-level continuity issue.
Resilience blueprint: assess, protect, isolate, recover, evolve: that sequence is useful because it ties identity governance to operational readiness rather than to static backup policy. The strongest programmes identify their critical digital coastline, protect the identity perimeter, keep isolated copies, and continuously retest the recovery path as the environment changes. The conclusion is that resilience must be maintained as a living process, not a one-time project.
What this signals
Identity recovery needs its own runbook: teams that only plan for file restore often discover that the real outage is in authentication and trust. Recovery design should therefore treat directory rebuild, synchronisation recovery, and policy validation as first-class workstreams, not as follow-on tasks.
Forest-level testing separates resilience from assumption: a backup that has never been exercised in a full restore tells you very little about real recovery readiness. Regular rebuild drills expose whether domain controllers, trust paths, and cloud identity settings can be brought back in sequence without cross-contamination.
Resilience is now measured by how quickly trust returns: the operational question after ransomware is not only whether data survived, but whether the organisation can safely reissue identity, re-establish access, and prove the environment is clean enough to operate.
For practitioners
- Audit identity recovery dependencies Map every business service that depends on Active Directory or Entra ID authentication, authorisation, and trust relationships so recovery order is explicit before an incident occurs.
- Protect clean identity backups Maintain immutable, air-gapped copies of AD system state and Entra ID configuration so a restore point cannot be altered by the same event that compromised production identity.
- Rehearse full-forest restoration Run recovery drills that rebuild domain controllers, trusts, and cloud identity settings end to end, then validate that access works without cross-contamination or reinfection.
- Limit identity blast radius Apply role-based access and privileged identity management to reduce how far ransomware operators can move if they reach the identity plane.
- Validate recovery against reinfection Include explicit validation steps after restore so identity services are checked for persistence, policy corruption, and unsafe synchronisation before normal operations resume.
Key takeaways
- Ransomware recovery often fails first at identity because AD and Entra ID are the systems that make access, trust, and authorisation possible.
- The article says more than 78% of human-operated attacks involve domain controller breaches, and it cites 22 days of average downtime and $1.5M average recovery cost.
- Clean, immutable, and air-gapped identity backups, plus full-forest recovery drills, are the controls that determine whether restoration is fast and trustworthy.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Identity recovery fails when compromised directory state is carried forward instead of replaced. |
| NHI-05 — Overprivileged NHI | Ransomware uses excessive identity reach to widen the blast radius inside AD and Entra ID. | |
| NHI-07 — Long-Lived Secrets | Ransomware recovery is harder when identity secrets persist long enough to be reused after compromise. | |
| Recommendation — Verify that identity recovery workflows replace compromised state rather than reusing it. Reduce standing identity reach so one compromised account cannot block recovery paths. Shorten the lifetime of identity secrets and treat stale credentials as recovery risk. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity recovery depends on restoring trustworthy access permissions and entitlements. |
| Recommendation — Restore access permissions only from verified identity state and revalidate entitlements after recovery. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article centres on identity restoration and credential integrity after ransomware. |
| Recommendation — Manage authenticators so recovery does not reintroduce compromised identity material. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article describes ransomware operators targeting identity credentials and trust paths to expand impact. |
| Recommendation — Map identity compromise indicators to credential access and lateral movement in detection logic. | ||
Key terms
- Identity Recovery: Identity recovery is the process of restoring identity systems to a trusted state after compromise. It includes containment, forensic validation, removal of persistence, and confirmation that access controls and directory relationships no longer expose the environment.
- Forest Recovery: Forest recovery is the coordinated restoration of an Active Directory forest after major compromise or destruction. It involves rebuilding domain controllers, trust relationships, and metadata in the correct order so the directory regains reliable authority instead of merely coming back online.
- Immutable Backup: An immutable backup is a copy that cannot be altered or deleted during its retention period. It protects recovery points from ransomware and accidental deletion, but it only delivers value when the organisation can restore from it successfully during an incident.
- Trust Relationship: A configured connection in which one identity, system, or vendor is allowed to rely on another without repeating full verification every time. Trust relationships are efficient, but they become risky when they outlive the business need or grant broader access than the original purpose justified.
Deepen your knowledge
NHI governance, identity lifecycle management, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or identity governance programme, it is worth exploring.
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org