.harma ransomware decryption?

Unfortunately, this is pertaining to Dharma (CrySiS) Ransomware with the .harma extension, like other variants, is not decryptable without paying the ransom and obtaining the private keys from the criminals who created the ransomware unless they are leaked or seized & released by authorities after making an arrest. Without the master private RSA key that can be used to decrypt your files, decryption is impossible. It is a hard truth. You can try  ID Ransomware but chance is very low. https://id-ransomware.malwarehunterteam.com/ or other decryptor but they are likely not for this newer version https://noransom.kaspersky.com/

If you are lucky, you can post one of your encrypted files here and see is a decryption tool is available
https://id-ransomware.malwarehunterteam.com/

The best prevention to Ransomware is only allowing whitelisted application access to sensitive paths, such as My Documents, and version-controlled/air capped backup. Never pay the ransom because you have no guarantee that you will actually get the decryption key and the funds are almost always used for organized crime.

If I encrypt a file, for security or malicious intent and I use proper encryption the following is true

Breaking a symmetric 256-bit key by brute force requires 2128 times more computational power than a 128-bit key. Fifty supercomputers that could check a billion billion (1018) AES keys per second (if such a device could ever be made) would, in theory, require about 3×1051 years to exhaust the 256-bit key space.

https://en.wikipedia.org/wiki/Brute-force_attack

Here are some articles related to security hardening that you might find useful

Get rid of over-privileged users, such as ones in DA
https://www.experts-exchange.com/articles/29596/Securing-Active-Directory-Administrators-Groups.html

Implement a delegation model
https://www.experts-exchange.com/articles/29366/Delegation-the-proper-way.html

Securely manage local admin passwords, and administrator members
https://www.experts-exchange.com/articles/31583/Active-Directory-Securely-Set-Local-Account-Passwords.html
https://www.experts-exchange.com/articles/30617/How-to-manage-local-account-passwords-from-Active-Directory-without-LAPS.html
https://www.experts-exchange.com/articles/29652/Strategy-to-centrally-manage-Local-Administrators-group-from-Active-Directory.html

Get rid of old accounts that might be used maliciously
https://www.experts-exchange.com/articles/30820/Active-Directory-Cleanup-Tool-ADCleanup.html

Implement tier-isolation to prevent tier jumps from lateral movement
https://www.experts-exchange.com/articles/29515/Active-Directory-Simple-Tier-Isolation.html

Create intelligence password policies
https://www.experts-exchange.com/articles/33078/How-to-create-an-Intelligent-Password-Policy-for-Active-Directory.html

Utilize host-based firewalls, Windows or otherwise
https://www.experts-exchange.com/articles/31687/Windows-Firewall-as-Code.html

Do AD password audits
https://www.experts-exchange.com/articles/29515/Active-Directory-Simple-Tier-Isolation.html

Create your file server structure using the least privilege principle
https://www.experts-exchange.com/articles/32349/FSMainFolder-Files-Server-Structure-Automation-Tool.html

and implement a security framework such as CIS
https://www.cisecurity.org/

Never found a solution.

You can close the question. I would think many would likewise face same challenge since those identifier link wouldn't shed more than required.