MicrosoftRafal_Fitt: Thanks for reaching and raising the question. 
Tactical Recovery often focuses on rapid execution and broad coverage to minimize the attack's impact as much as possible. The actions taken are modular and guided by forensic data. If there is evidence of compromise, a change will be initiated to regain administrative control of AD; otherwise, the focus will shift to the next step in the recovery playbook.
During this phase, the DPAPI component is addressed as a tactical measure, with the understanding that strategic recovery will follow. This will likely necessitate a new architecture model for identity and access management, and creating a new forest/domain will certainly be part of that process.
