AD-INF-011: No recent backup of the domain¶

medium Infrastructure MITRE ATT&CK T1490 Reads: LDAP

The domain partition has not been backed up in the last seven days, or never, so recovering from ransomware or a forest compromise would mean rebuilding.

Also known as: ad-backup

Why it matters¶

Ransomware operators who reach domain admin routinely encrypt or wipe domain controllers together with everything else, and some delete backups first. A forest compromise can also leave so many unknown changes behind that the only trustworthy way back is a restore from before the intrusion. Both depend on a recent, AD-aware system-state backup of at least one DC per domain.

The Recycle Bin (AD-INF-002) covers deleted objects only; it does not help when DCs are destroyed or the directory itself cannot be trusted. A backup older than the tombstone lifetime (180 days by default) cannot be restored at all.

How ad-doctor detects it¶

Every AD-aware backup of a DC updates the dSASignature attribute on the naming contexts it backs up. ad-doctor reads msDS-ReplAttributeMetaData on the domain object and takes the ftimeLastOriginatingChange of dSASignature as the time of the last backup of the domain partition, from any DC.

The domain is reported when that time is more than seven days before the scan, or when it is the zero date (1601-01-01), which means the partition was never backed up. If the metadata does not contain dSASignature at all, the check stays silent. The finding has one object, the domain name, for example corp.example, and the detail gives the age in days.

Attributes and probes read

msDS-ReplAttributeMetaData (dSASignature)

Severity¶

Always medium: a missing backup is not an attack path, but it turns any destructive attack into a rebuild of the forest.

False positives and limits¶

Backups that are not AD-aware, such as hypervisor snapshots taken without the VSS writer for Active Directory, or file copies, do not update dSASignature. They are also not supported ways to restore a DC, so the finding stands.
Lab and test domains without backups by design: accept the finding (accepted risks).

Fix¶

Check when each partition was last backed up, as seen by a DC:
```
repadmin /showbackup *
```
Take a system-state backup of at least one DC per domain, daily, with Windows Server Backup or an AD-aware backup product. With Windows Server Backup (the feature must be installed):
```
wbadmin start systemstatebackup -backupTarget:E:
```
Keep copies offline or immutable, out of reach of the domain's own administrators, so an attacker with domain admin cannot delete them.
Test restores regularly in an isolated network, following the forest recovery guide, and document the procedure.

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-INF-011

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-INF-011"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

AD-INF-002

References¶

Microsoft and vendors

MITRE ATT&CK

T1490

Available since 0.1.0.