Was just (randomly) inspired for more Random Admin Advice: Keep your backup storage's management plane completely separate from any directory services (AD, etc) you may be using. You can connect it to authorize clients for both backup and restore purposes, but all management of the system and retention periods should be done with a distinct set of accounts managed locally on-device, and ideally (although not always possible) require physical hands-on-keyboard for certain operations.

The true key to good backups is don't let AD dictate who can delete backups. In the event of infrastructure compromise, step one of ransomware after getting an idea of what's going on is "destroy backups." If there's no trivial way for them to pivot from domain admin to the backup server, that task becomes a hell of a lot harder.

(Also, this is your periodic reminder to A: check your backups, and B: make sure they're on a different disk/host than the live copy, though with some exceptions for oopsie-rollback snapshots)