Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsContain the incident before restoring SharePoint Server. Then identify a recovery point that predates the compromise, restore in an isolated environment, choose a recovery scope that matches the damage, and validate the recovered farm and content before reconnecting it to production. The exact procedure depends on your SharePoint Server version, SQL Server setup, backup platform, and the extent of the attack.
1. Contain the attack and establish what was affected
Coordinate with your incident response team before starting a restore. Determine which accounts, devices, applications, and systems may be compromised, and isolate affected systems according to your organization’s incident response plan. Microsoft’s Microsoft Incident Response ransomware approach and best practices describes these actions at an enterprise level; it is not a SharePoint-specific containment runbook.
As an Amazon Associate I earn from qualifying purchases.
Preserve evidence and protect known-good systems as directed by the incident commander. Do not assume the SharePoint farm is the only affected part of the environment: attacker access to administrator accounts, SQL Server, backup infrastructure, or connected systems can undermine a recovery even if SharePoint itself is restored.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →2. Choose a recovery point and a safe restore environment
Use the incident timeline to select the most recent backup you can establish was created before the compromise. A recent backup is not necessarily a clean one: ransomware may have been present before it was detected. If you cannot establish when the attacker gained access, involve incident responders in assessing which recovery points are trustworthy.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Microsoft’s Azure Backup ransomware FAQ recommends restoring to an isolated, secure network, checking a smaller set of data first where appropriate, scanning restored data, and returning it to production only after it has been assessed as clean. This is general ransomware-recovery guidance, not confirmation that Azure Backup supports the SharePoint workload in your particular deployment. Verify the workload and version support for the backup product you actually use.
3. Match the restore scope to the damage
Do not restore the entire farm by default if the incident affected only a smaller part of SharePoint. Microsoft’s SharePoint Server restore guidance describes full-farm recovery for a whole-farm failure or when partial recovery is not possible. For a limited incident, identify whether recovery is needed for a database, service application, site collection, list or library, or individual document, then use the procedure for that object and SharePoint version.
Rank #2
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
| Recovery route | When it fits | Important limitation |
|---|---|---|
| Full farm restore through Central Administration or SharePoint PowerShell | The farm has failed, or partial recovery is not possible. Microsoft documents both SharePoint Server tools for farm recovery. | Restoring the farm does not automatically start every service application; services may need to be started and trust relationships re-established. See Microsoft, Restore farms in SharePoint Server. |
| SQL Server database restore | A database-level recovery is appropriate, or SQL Server tools are part of the documented farm recovery route. Microsoft says SQL Server tools can restore most farm databases. | SQL Server tools do not restore the SharePoint farm configuration. Configuration must be restored separately through Central Administration or SharePoint PowerShell. See Microsoft, Restore farms in SharePoint Server. |
| Recovery of a service application, site collection, list or library, or document | The incident is limited to a specific SharePoint component or content item and partial recovery is possible. | The applicable steps depend on the object and SharePoint version; use the corresponding Microsoft recovery procedure rather than assuming a full-farm restore is required. See Microsoft, Restore farms in SharePoint Server. |
Before selecting a route, account for dependencies outside the data you are restoring. For example, SharePoint backups preserve Business Data Connectivity external content type definitions but not the external data source itself, according to Microsoft’s farm restore guidance.
4. Check backup compatibility and prerequisites
- SharePoint version and update level: Microsoft says a backup from one SharePoint version cannot be restored to another version, and the destination farm’s update level must not be lower than the backup’s. Confirm these details before restoring; see Prepare to back up and restore farms in SharePoint Server.
- Backup location: Confirm that the backup files are available to the relevant SQL Server and SharePoint machines, as required by the restore route.
- SQL Server Transparent Data Encryption: If TDE is enabled, its key is not included in the SharePoint/SQL backup. Microsoft’s preparation guidance says to restore the key manually before restoring the encrypted data.
- Credentials and connected systems: Confirm that required credentials and dependencies are available and have not themselves been compromised. Establish how external data sources and other connected services will be secured and validated.
5. Restore databases and farm configuration in the right sequence
For the SQL-based database restore sequence documented by Microsoft, restore the last full database backup, apply the most recent applicable differential backup, then apply transaction log backups in order. Use RECOVER WITH NORECOVERY while additional logs still need to be applied, and RECOVER WITH RECOVERY when the required logs are complete. When restoring the User Profile database, Microsoft specifically instructs administrators to restore the associated Social database as well. Follow the procedure for your deployed SharePoint and SQL Server versions.
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
A farm backup can include configuration and Central Administration content databases, but Microsoft says SharePoint Server tools cannot restore those databases. SQL Server tools can restore most farm databases, while farm configuration must be restored separately using Central Administration or SharePoint PowerShell. A configuration-only backup cannot restore content databases together with the configuration. Use Microsoft’s version-specific farm recovery steps rather than improvising database attachment or service-provisioning operations.
6. Validate the restored farm before cutover
Keep the restored environment isolated while you and the relevant application owners verify it. Define acceptance checks from your incident response and platform runbooks; the precise forensic and application checks depend on your farm and business requirements.
Rank #4
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- Confirm the restored content and critical SharePoint services behave as expected.
- Scan restored data using your organization’s security controls and incident response process.
- Verify that the recovery environment is not still connected to compromised systems or exposed to compromised credentials.
- Return the environment to production only after responders and business owners determine that it is safe and usable.
After service is restored, confirm that backup protection is configured and that backup jobs complete successfully. Microsoft’s Azure Backup ransomware FAQ recommends checking backup health after recovery; that guidance does not establish product support for every on-premises SharePoint deployment.
7. Make the next recovery more predictable
Set recovery objectives with business owners before the next incident. Microsoft’s SharePoint Server disaster-recovery guidance says strategy is driven by the organization’s recovery time objective (RTO) and recovery point objective (RPO): the time needed to restore service and the amount of data loss the business can accept. Compare those objectives with backup frequency, the dependencies each backup covers, and restore procedures that have actually been tested.
Best Value
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
For each recovery path, document which components it restores, which it leaves dependent on separate procedures, what version and update-level compatibility it requires, and who can authorize a production cutover. Include external data sources, encryption keys, service application startup, trust relationships, and backup-system access in that plan. A successful backup job is not by itself proof that the farm can be recovered to a clean, usable state.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
