---
id: 6036
title: "Your Active Directory was compromised, is it all lost? – Part 2"
source_domain: semperis.com
source_url: "https://www.semperis.com/blog/your-active-directory-was-compromised-is-it-all-lost-part-2/"
published_at: "2019-03-20T15:26:38Z"
tags: ["incident-response", "active-directory", "ransomware", "backup", "rootkit", "forest-recovery"]
phying_url: "https://phying.com/item/6036"
lang: en
---

# Your Active Directory was compromised, is it all lost? – Part 2

## Summary

Recovering a compromised AD (part 2): restore from the day-before backup via full forest recovery—hours if automated, four to five business days manually—and tackle the rootkit reinfection challenge.

## Intelligence Metadata

- **Sources:** semperis.com
- **Published:** 2019-03-20T15:26:38Z
- **Original:** https://www.semperis.com/blog/your-active-directory-was-compromised-is-it-all-lost-part-2/
- **Phying News:** https://phying.com/item/6036