Active Directory compromise can devastate operations. This playbook outlines how to contain, investigate, and recover.