Digital Forensics

Are there any decent/recommended tools out there (ideally free/open source) which would be useful in undertaking some forensic work on a Windows Domain Controller which has been compromised? As I've not done it before, I was looking for something where the learning curve isn't too steep (at least initially).

Also, are there any good procedures to follow that can guide you through the process of what/how to look for on a compromised server? It was a ransomware incident, so there …

compromised controller curve cybersecurity digital digital forensics domain domain controller forensic forensics free good isn open source procedures tools windows work