DMA Locker

[ataylor]

Hi,

 

 

A Family member of mine runs a business with a small network, a few weeks back this was hit with DMA locker and he lost nearly everything including his backups.

 

There has been a local company that has been looking at this for him, and for the most part, they have got him up and running.

 

He called me in as he is getting fed up with them and thinks they are not doing a proper job and it's costing him a fortune.

 

After a quick review of his network, it looks like he still has encrypted files all over the place, including on his DC where I could not even read his group policy settings as they are also encrypted. None of his backups are currently functional and any user on his network can access the NAS to create/delete files.

 

Also, he noted that all of his clients are using POP to retrieve emails which are deleting his emails on the server.

 

What I'm thinking to resolve his problems:-

 

Considering his network consists of around 6-8 desktop clients what I am currently thinking is first get a backup of every machine including the current server (A lot of his computers run specific software for machines used in engineering) and set NAS to have much tighter security for backup storage.

 

Heavily document everything on his network.

 

Install a new DC from fresh alongside the current one, migrate all of his functional data to the new domain, reimage all of his machines and hook them up to the new domain.

 

Migrate his emails over to O365.

 

Set each computer including the server to backup to the NAS.

 

 

My question is,

 

1. Would the free edition of veeam backup be suitable for machine level backups?

2. He has a licence for server 2012 essentials, can I virtualize his DC on this? I'm used to educational licencing.

3. I'm also looking into a cloud solution for his backups, what do people recommend?

[localzuk]

Sounds like a sensible plan.

 

For the "backup" of each machine, I'd just use Clonezilla.

 

Essentials can't be used as a VM host, but it can be put in a VM. You could host it on ESXi or something like that?

 

For cloud backup, I'd say get Cloudberry Backup and put the data in Azure storage.

[ColinP]

For such a small network , it would be better to strart from scratch, if gpo's have been effected you never know what else is damaged