In part one , we discussed how restoring Active Directory (AD) after a ransomware attack isn’t as simple as restoring the latest backup—because that backup might already be compromised. Remember: Blind restores can be dangerous. Restoring without validating means restoring the attacker’s access alongside your data.