The Practical ROI of a quick Active Directory recovery

data protection day, ROI
While every IT manager or administrator knows that a solid Active Directory recovery plan is an essential component of any business continuity strategy, calculating an optimised AD recovery plan’s practical return on investment (ROI) is notoriously tricky. Too many variables are at play to generate a defensible, exact calculation. And to set expectations upfront: I won’t offer any interactive ROI calculator here in this article. 
Instead, Sean Deuby, Director of Services, Semperis, looks at a few practical ways to see a return on your investment in ensuring a proper AD recovery, allowing you to do your own calculations and come to your own conclusions. Of course, losing one domain controller is a problem in itself, but let’s look at another increasingly common scenario that has catastrophic consequences: a ransomware attack that takes out every domain controller across all company sites. In that situation, recovering AD can be a white-knuckle, under-the-gun challenge. 

In the last year, we’ve discussed scores of ransomware attacks where cybercriminals modified AD in one way or another — far beyond the basic changes to user accounts or passwords — to gain entry into information systems and move laterally to propagate malware. Ransomware architects now have engineers on staff dissecting AD and its security updates, looking for opportunities to elevate permissions and quickly distribute malware across the entire organisation. Post-attack forensics from previous ransomware attacks involving AD have revealed that threat actors primarily focus on changes to group accounts, user accounts, Group Policy objects, the SYSVOL, and domain controllers. With these cybercriminal tactics in mind, consider the following factors in calculating your own AD recovery ROI: Cost of operational losses. 

A material part of your operations likely relies on AD being up and running to authenticate users as the basis for providing access to applications, systems, and data. For every hour that AD cannot operate, how much revenue or productivity would your business lose? How many hours, days, or weeks would it take before the business passes a point of no return and cannot financially recover? Remember the ransomware attack on the City of Baltimore? Their recovery of operations took months and cost over US$18mn.

Lack of a business continuity plan that includes AD 

If your organisation is mature enough, you have a BC/ DR plan in place defining the work needed to restore business operations after an outage. Most plans account for loss of infrastructure or loss of a location after a natural disaster. But few companies have a plan specifically for restoring business after a cyberattack, especially one as unpredictable as a ransomware attack. The way you recover AD in a scenario like this depends on what changes cybercriminals made within AD. You might plan to recover AD back to a previous version, but how do you determine how far back you need to go to find a known secure version? What AD-dependent systems, services, and applications will be affected or won’t function at all because of a broad-stroke recovery to an earlier AD state? Are you confident that you can even locate a recent, malware-free backup from which to restore? Without a plan or an ability to understand what was changed in AD before recovering, your organisation will spend incalculable time fixing all the problems the recovery caused. 

Recovery might not be the answer 

If all the changes being made by the bad guys during an attack boil down to, let’s say, adding an account to the Domain Admins group, then recovering AD to a few days ago or last month might not be the right answer. Instead, perhaps the less costly method is to monitor changes in AD and have the ability to either disallow changes to “protected” accounts (like the Domain Admins group) or to revert a change to a sanctioned configuration automatically. 

The considerations above summarise to three risks: 

1.The risk of a slow recovery

2. The risk of a recovery that creates more remediation work

3. The risk of a recovery that might be considered overkill for the nature of the changes made to AD.

Instead of looking at the ROI of AD recovery using some calculator you found online, the better choice is to work through several real-world scenarios and evaluate how your current means of AD recovery would fare. This can be done by answering the following questions based on the factors outlined above: 

• What critical parts of the operation depend on AD to function? What is the estimated cost of their downtime? 

• How long will it take to recover AD based on the changes made during an attack

• Do you have visibility into what malicious changes were made in AD and, if not, how far back will you need to investigate and how long will that take you? 

• Will the recovery impact any other parts of operations that you will need to fix and, if so, how long will that take? (Remember that some number of both user and computer account passwords will not match, impeding the ability to log on to the domain. Plus, earlier versions might be missing accounts, group memberships, DNS records, etc.) 

• Are you confident that recovery will put you into a known-secure state? Beware of the difference between resuming business operations and recovering business operations: If you don’t have a clean, malware-free backup from which to recover, you run the risk of reintroducing the same vulnerabilities that left you open to attack in the first place. 

In short, the ROI of AD recovery has much more to do with your current ability to recover to a known-productive and known-secure state post-attack than it does with an online ROI calculator that doesn’t account for the myriad variables involved in a ransomware attack. By walking through some scenarios and thinking specifically about your current recovery abilities, you will expose costs that can be eliminated by having a proper AD recovery solution in place—one that is designed to protect against, prevent and recover from malicious changes AD.


About Semperis

For security teams charged with defending hybrid and multi-cloud environments, Semperis ensures integrity and availability of critical enterprise directory services at every step in the cyber kill chain and cuts recovery time by 90%. Purpose-built for securing Active Directory, Semperis’ patented technology protects over 40 million identities from cyberattacks, data breaches, and operational errors. As a result, the world’s leading organisations trust Semperis to spot directory vulnerabilities, intercept cyberattacks in progress and quickly recover from ransomware and other data integrity emergencies. Semperis is headquartered in New Jersey and operates internationally, with its research and development team distributed between San Francisco and Tel Aviv. Semperis has released its Active Directory Security Halftime Report. The report will be updated on a periodic basis to serve as a timely, concise index of resources for organisations that have prioritised hardening their Active Directory and Azure Active Directory defences against escalating cyberattacks.

For more news from Top Business Tech, don’t forget to subscribe to our daily bulletin!

Follow us on LinkedIn and Twitter


  • ROI, Security & Data, The Practical ROI of a quick Active Directory recovery

    Sean Deuby brings 30 years’ experience in Enterprise IT and Hybrid Identity to his role as Director of Services at Semperis. An original architect and technical leader of Intel's Active Directory, Texas Instrument’s Windows NT network, and 15-time MVP alumnus, Sean has been involved with Microsoft identity technology since its inception. His experience as an identity strategy consultant for many Fortune 500 companies gives him a broad perspective on the challenges of today's identity-centered security. Sean is also an industry journalism veteran; as former technical director for Windows IT Pro, he has over 400 published articles on Active Directory, Azure Active Directory and related security, and Windows Server. He has presented sessions at multiple CIS / Identiverse conferences.

The rise of lights-out automation in medtech

Amber Donovan-Stevens • 14th September 2021

The global pandemic sped up digital transformations for businesses across the globe. Dr Chantelle Kiernan, Senior Scientific Advisor – Innovation & Digital Transformation (Manufacturing), IDA Ireland explains how the health crisis accelerated lights-out manufacturing in Ireland’s medtech industry.

5G: Pushing the world forward through emerging technologies

Amber Donovan-Stevens • 04th August 2021

As we look to the future, the adoption of 5G networks across the globe is set to revolutionise the way we do business. It promises to significantly upgrade our technology toolkit, improving operations and providing solutions that will create a more inclusive, connected and sustainable world, says Bhushan Patil, SVP EMEA, Tech Mahindra.

Join our webinar on 28th September: How the digital nomad generation influences business behaviour