The ransomware virus destroyed the files in the SYSVOl and NETLOGON folders on all CDs, who can advise in this case?

Question

Active Directory

There are 3 domain controllers. The ransomware virus (.harma) penetrated one of them and encrypted the SYSVOl and NETLOGON folders, and later, during replication, penetrated the rest. Perhaps someone can suggest a solution to the problem.
The sysvol and netlogon folders raised from the shadow copy can help

Answer 1

No backups or VSS snapshots

I'm afraid that's all.

Answer 2

who can advise in this case?

Use this situation as a visual aid about the benefits of backups, setting access rights and the harm of working under the administrator.

Answer 3

I would advise something, but I'm afraid the author may follow my advice literally ...
If I were your director, I would pay the extortionist (if there is a contact there, because many cryptographers are made by shkolota and there is not even soap there) - and then I would withhold this the amount of your salary :)

Answer 4

Change gender, move to Mexico

Answer 5

Run... throw away your phone and run... Make backups at your new job.