See Identity Resilience in Action

Transcript

Chapter 1: Rising Threats to Identity Systems Cyberattacks targeting identity systems are rising fast. Active Directory and Entra ID serve as the core of user access, application availability, and business continuity — making them prime targets for attackers. Throughout this demo, we’ll highlight how Commvault’s capabilities address the unique needs of technology and security leaders through proactive risk assessment, real-time threat detection and response, automated clean recovery, and unified management. Commvault provides identity resilience, protecting Active Directory and Entra ID from attacks, misconfigurations, and compromise. Our unified control plane helps enable you to assess risk, identify malicious activity, and recover cleanly — all from one platform. Every strong defense starts with visibility. Our AD vulnerability assessments conduct a comprehensive identity posture scan, identifying misconfigurations and exposures that attackers might exploit. This helps enable you to proactively reduce risk and support compliance. It’s a way to catch issues before they turn into incidents. The overall score indicates the level of risk based on the number and severity of indicators of exposure identified. Let’s look at one example: accounts with passwords that never expire. These credentials provide ideal opportunities for attackers. Each indicator has a severity rating and outlines the potential impact if it is exploited. Additionally, Commvault specifies the steps needed to remediate each vulnerability — including all users whose passwords are set to never expire. Assessments give you the map. But the moment an attacker acts, you need to know fast. Commvault’s rapid AD auditing provides visibility into change, alerting you to suspicious activity as it happens. All changes made to Active Directory are recorded with essential details. Both successful and failed logins are also captured, providing a complete picture of user activity. Here, we see a sequence of suspicious AD events: a backdoor account created using a compromised user account, added to domain admins, and a malicious Group Policy Object created and linked to the domain head — designed to deploy ransomware. Once you identify the suspicious activity, you can easily filter the activity feed to find all other changes made by the compromised account. Commvault AD auditing not only detects changes — it enables you to rapidly contain them. From the same view, you can roll back the malicious GPO link, restoring the environment to a known-good state.

Chapter 2: Proactive Risk Assessment and Threat Detection Reversing the attack chain with one action helps minimize downtime, limit the blast radius of attacks, and maintain trust in your environment. Your rollback halts the attack — but how do you prevent it from happening again? Let’s revisit our assessment results. The same compromised account appears in our results. The account had a stale password that was set to never expire. The assessment highlights other accounts with the same vulnerability. By removing non-expiring credentials and strengthening password policies, you close one of the most common attacker entry points. Even with strong defenses, no organization is immune to compromise. Commvault Forest Recovery automates one of the most complex processes in IT: rebuilding an entire Active Directory Forest after ransomware or corruption. Commvault’s visual view of the AD Forest displays the topology of domains and domain controllers and highlights the key roles each DC holds. A forest recovery may involve 50 to 100 steps or more, depending on the number of domains and DCs. Using intuitive runbooks, Commvault orchestrates every step. We take recovery further with Recovery AD to clean VM, which allows rebuilding domain controllers on newly created systems — enabling faster, cleaner recoveries and less business disruption. Modern enterprises operate hybrid environments with identities spanning on-premises AD and cloud-based Entra ID. Commvault’s unified control plane provides assessment, auditing, detection, and recovery across both platforms. This simplifies operations, reduces tool sprawl, and assures leadership that hybrid identity resilience is truly unified. Commvault delivers a comprehensive approach to identity resilience — helping you proactively assess risks, detect and contain threats quickly, and recover your Active Directory and Entra ID environments with confidence. With Commvault, you’re not just backing up data. You’re protecting the foundation of your business.