Semperis Directory Services Protector for Active Directory

Active Directory (AD) underpins identity and access for most large enterprises, including those running mixed Windows and Unix environments and those using identity-as-a-service platforms such as Okta, OneLogin, and Azure Active Directory. Even in cloud-forward deployments, organizations still rely on on-premises AD to populate cloud directory accounts and/or authenticate users, making AD compromise or corruption a high-impact event for hybrid environments. Attackers commonly start with a single compromised machine or user credentials, then perform directory reconnaissance to locate high-value targets, potentially escalating to Domain Administrator privileges. Automated ransomware is increasingly using AD queries to enumerate computers and accounts, spread laterally, and in some cases directly encrypt domain controllers, crippling operations.

AD recovery is difficult because long-lived deployments accumulate complexity across versions, changes, and diverse use cases; failures can stem from human error, hardware issues, software corruption, and malicious actions. Examples include schema extension corruption, functional level changes that break legacy authentication, privileged misuse of permissions, ransomware encryption of domain controller data, single critical domain controller failures, accidental Group Policy deletion, and incorrect changes to critical application accounts/groups. Microsoft lacks a built-in forest recovery process, relying instead on a largely manual forest recovery guide that can take days even with good backups.

Semperis positions three capabilities to close these gaps: full AD forest recovery, state management, and a real-time activity dashboard. Its AD Forest Recovery product performs regular domain controller backups preserving attributes, objects, and relationships for full or partial recovery, stored on-premises or in the cloud. DS Protector for Active Directory (DSP) v2.5 tracks AD modifications across objects (including DNS-integrated zones and GPOs), consolidates logs and replication data into a timeline view, and supports granular rollback of individual or grouped changes, governed by role-based access control, reporting, alerts, and integrations, with additional alerting and SIEM/ticketing integrations planned for v2.6 and beyond.

• Active Directory is described as the core IT identity infrastructure system for almost all large global organizations.
• Organizations using Okta, OneLogin, or Azure Active Directory can still depend on on-premises AD for account population and/or user authentication.
• Attackers often begin by compromising one computer or obtaining one user’s domain credentials.
• Automated ransomware programs such as Samas use AD queries to enumerate computers or accounts and then spread to other systems.
• Ransomware can strike domain controllers directly and bring networks to a halt.
• Microsoft does not provide a built-in forest recovery process for Active Directory.
• The Microsoft forest recovery guidance is described as lengthy and largely manual, with recovery potentially taking days even with current backups.
• DS Protector for Active Directory (DSP) version 2.5 was released in late 2017 and was formerly named Active Directory State Manager.
• DSP’s scope includes all AD objects as well as DNS-integrated zones data and Group Policy Objects.
• DSP requires core agents installed on two domain controllers per domain to initiate local change monitoring and rollback operations.

• “Success attracts cyberattackers like flies to honey.”
• “Should AD be compromised or corrupted, the whole enterprise hybrid cloud is in trouble.”
• “Recovery is easier said than done.”
• “AD forests are susceptible to human error, hardware failure, and software corruption.”
• “Microsoft does not provide a built-in forest recovery process.”
• “Recovery could take days, even if complete and current backups are available.”
• “DSP consolidates logs from disparate AD domain controllers combined with data gathered directly from the AD through replication API’s and provides a timeline graphical view of changes…”
• “AD itself cannot prevent a domain administrator (DA), a privileged user, or a hacker who has obtained the right domain credentials from violating those policies and procedures.”
• “No longer will the enterprise depend entirely on careful dashboard monitoring, or log review by an operator to ensure policy violations get flagged.”
• “Automated rollback of unauthorized changes to AD is important because it could drastically reduce the time hackers or insider threats have to abuse illicitly-gained privileges.”