Infrastructure security conversations tend toward segmentation, encryption, and immutable storage. All worthwhile. All enforced by systems that authenticate somebody, and the somebody is usually authenticated by one directory.
If that directory is compromised, the question is not which controls exist but which controls that directory can undo.
The exercise
Draw your systems. For each, write down what identity source it trusts for administrative access.
Backup infrastructure. Storage array management. Hypervisor management. Network devices. The monitoring platform. The hardware management controllers on every server. Cloud accounts.
The common answer in most enterprises is: the same directory as everything else, or a directory that trusts it.
Once that is on paper, the picture is usually uncomfortable. An attacker with domain administrator rights does not need to defeat your immutable backup storage, because they can authenticate to the appliance that enforces the immutability.
The specific places it goes wrong
Backup infrastructure joined to the production domain. The most common and the most consequential. The thing that recovers you from a compromise shares a fate with the compromised thing.
Hardware management controllers on a shared directory. Out-of-band management can power off, reinstall, and mount media. It is the most powerful access in the building and it is frequently the least governed.
Service accounts with broad rights and passwords that never change. Often documented in the place attackers look first.
Nested groups nobody has audited. Effective membership of privileged groups is frequently much larger than the intended membership, through nesting that accumulated over a decade.
Cloud federated to the same directory. Convenient, and it means an on-premises directory compromise reaches the cloud environment where you may have thought your recovery copy was safe.
The hypervisor. Administrative access to the virtualization platform is access to every VM’s disk. A directory that grants it is a directory that grants everything.
What actually helps
Separate identity for recovery infrastructure. Backup and recovery systems authenticate against something that is not the production directory, with their own credentials, ideally with hardware-backed multi-factor. This is unglamorous, moderately annoying, and probably the highest-value change most organisations could make.
Privileged access workstations for tier-zero administration. Administration of the directory, the hypervisor and the backup platform happens from dedicated machines that do not browse the web or read email.
Out-of-band management on an isolated network with local credentials and no directory trust.
Regular effective-membership audits. Not group membership: effective membership, after nesting. The number surprises people every time.
Time-bound elevation. Standing administrative rights are the thing being stolen. Rights that exist for two hours after an approval are a much smaller prize.
The question to take to your next architecture review
If an attacker holds domain administrator rights for four hours, what survives?
Go system by system. For each, name the credential that controls it and say whether that credential is inside the compromised domain. The exercise takes a morning and it reorders most people’s security roadmap.
The answer you want is that at least one copy of your data, and the means to restore it, sits behind credentials the attacker does not have. If there is no such thing, then every other control is a delay rather than a defence.