Your infrastructure engineer hates you

Here we go again, as an industrial firm watched 254 servers and 3,284 workstations get held hostage by their own infrastructure engineer demanding 20 bitcoin. Why do we even bother handing out unchecked domain controller keys when someone can simply schedule mass password wipes before lunch? To prevent your own staff from holding the estate to ransom like this, one might consider locking down domain controller permissions and monitoring rogue scheduled tasks, assuming anyone still possesses the will to audit admin privileges.