Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

When Your SharePoint Sites Get Encrypted


Published on

If you are using Office 365 and SharePoint on-line, this is a story about a small business who got the encrypto virus (ramsomware) on their company networked computers.
#SharePoint, #Office 365

Published in: Technology
  • Be the first to like this

When Your SharePoint Sites Get Encrypted

  1. 1. What Happens When Your SharePoint Sites Become Encrypted? Originally appeared on my blog May, 2017, at sharepoint-sites-get-encrypted/
  2. 2. What Happens When Your SharePoint Sites Become Encrypted? • Here’s the story – An employee clicked a link and ransomware was installed – it spread to the entire small business of about 15 computers that all had SharePoint 2013 synced to their local machines. • How do you know if a file has been encrypted? They will have a non-typical extension. In our case, most of our documents were .xlsx or .docx and now the extension was very long and had the word ‘satan’ in it. How appropriate! • My job wasn’t to take out the virus – their IT person did that. My job was to stop the syncing and contact Microsoft to get the sites restored.
  3. 3. What Happens When Your SharePoint Sites Become Encrypted? • First – I logged into each work station to stop OneDrive from syncing by right-clicking on the cloud and then exiting. Then I deleted all of the folders to get them out of the way. • Second – I went to the admin center and put in a call to Microsoft • Third – deal with Microsoft help—first, they made sure I couldn’t go to the recycle bin and do a restore on my own (this seemed pointless since all files were encrypted)
  4. 4. What Happens When Your SharePoint Sites Become Encrypted? Microsoft Will Send You an Email with Questions like these that needs to be filled out and sent back: • What is the URL of the site collection/sub-site URL that contains the item, or items, that have to be restored? • What is the URL to the item, or items, that has to be restored? If this is unknown, specify a location as close as possible. • What is the reason for the restore request? For example, missing item, unwanted changes, and so on. • Is version history restore working? • Where you able to check, verify and restore the data from the Recycle bin? • Sample affected files Names: (should be 5 or more) • When were the item, or items, last known to exist in the desired state?
  5. 5. What Happens When Your SharePoint Sites Become Encrypted? Things To Know About Getting Your SharePoint Sites Restored By Microsoft • Microsoft makes daily backups of each SharePoint site • The backup is kept for 14 days – on the 15th day, Microsoft will backup whatever is there, i.e. the encrypted files, and all chance of getting your original documents are gone! • Lesson: be sure you contact Microsoft ASAP if your sites get encrypted!
  6. 6. What Happens When Your SharePoint Sites Become Encrypted? The Client Had Their Sites Restored on the 13th Day! • Our experience was that we had to reach out to Microsoft for updates on the status of our restore. They didn’t update us. • Each time we were told that ‘multiple teams’ are working on your restore and we have to wait for them. • When we got the email that the SharePoint Sites were restored, they asked us to log in and check things out. • We could only trust that they truly restored every file and folder because we were not backed up any other way.
  7. 7. What Happens When Your SharePoint Sites Become Encrypted? Doing the Resync Was Next • Each workstation needed to be resynced. I had the NextGen Sync Client on each of them. It didn’t have to be reinstalled, just restarted by going to the Windows button and typing in OneDrive. • Then each site had to be resynced computer by computer • Their SharePoint sites and OneDrive for Business were back up and running. (None of these workstations had OneDrive consumer accounts.)
  8. 8. What Happens When Your SharePoint Sites Become Encrypted? Some Additional Information For You: • For things that can’t be recovered the self-help, you can contact Microsoft Support. However, backups are only stored for 14 days. • Backups occur every 12 hours. • Only Site Collections can be recovered. Not individual items. • For self-help recovery, things remain in the recycle bin for 90 days. However, it may remain a little longer, Some say up to 93 days but this has never been confirmed. • Items deleted will first go in to the end-user recycle bin, items deleted from end-user recycle bin will go in to the Site Collection recycle bin
  9. 9. What Happens When Your SharePoint Sites Become Encrypted? These are on-line resources I found: • Restore a deleted site collection • SharePoint feature availability across Office 365 plans • SharePoint Online and OneDrive for Business software boundaries and limits • Restore option in SharePoint Online These are the ‘helpful’ links support sent me Restore options in SharePoint Online -options-in-sharepoint-online/ (Cloud) Tip of the Day: SharePoint Online restore options 6/cloud-tip-of-the-day-sharepoint-online-restore-options/
  10. 10. Originally appeared on my blog May, 2017, at  If you can’t afford downtime with your SharePoint, invest in a backup system that you control.  If you are a larger business, go for a true 3rd party SharePoint backup solution.  If you’re a smaller business, perhaps a solution like BackBlaze or Carbonite would be a good fit. I know with BackBlaze, I can go back in time up to 30 days to do a complete restore. Please connect with me on-line Twitter - @lynntotherescue LinkedIn - YouTube – My Channel Subscribe to my weekly newsletter Email me at