  Ransomware has become an increasingly popular type of malware across the past
decade and continues to rise in popularity due to its high profitability.
Organisations and enterprises have become prime targets for ransomware as they
are more likely to succumb to ransom demands as part of operating expenses to
counter the cost incurred from downtime. Despite the prevalence of ransomware
as a threat towards organisations, there is very little information outlining
how ransomware affects Windows Server environments, and particularly its
proprietary domain services such as Active Directory. Hence, we aim to increase
the cyber situational awareness of organisations and corporations that utilise
these environments. Dynamic analysis was performed using three ransomware
variants to uncover how crypto-ransomware affects Windows Server-specific
services and processes. Our work outlines the practical investigation
undertaken as WannaCry, TeslaCrypt, and Jigsaw were acquired and tested against
several domain services. The findings showed that none of the three variants
stopped the processes and decidedly left all domain services untouched.
However, although the services remained operational, they became uniquely
dysfunctional as ransomware encrypted the files pertaining to those services
