Restoration priority: AD versus email versus ERP
Overview
Restore order depends on dependencies and blast radius. Wrong order burns hours rebuilding twice.
General pattern
- Network/DNS/DHCP viability.
- Identity (AD/Entra) if attacker touched it—forest recovery may precede app restores.
- Core productivity (email/files) per RTO tier.
- ERP/LOB after identity clean—reconnect only from trusted subnets.
If AD is suspect
Do not restore dirty AD backup into live—green forest or vendor-guided recovery; reset KRBTGT twice post-clean per Microsoft IR guidance.
Exchange Online may be intact if on-prem was target—verify -mailbox audit tampering; OAuth apps inventory.
ERP
Often slowest—parallel read-only reporting instance for finance cash decisions if licensed.
Testing
Restore drill checklist itemized: can user log in, receive mail, post AR invoice safely?
Business tie-in
CFO picks revenue-critical order within risk appetite—document overrides to CISO objection where they occur.
Communication
Status page: “ERP intentionally delayed until identity attested clean.”
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...