IT emergency: what to do in the first 30 minutes

The Microsoft 365 account is locked

Sign-in is refused, staff can no longer reach mail, Teams or OneDrive, or Microsoft reports a suspicious sign-in.

The first steps

1. Read or photograph the error message exactly: it tells you whether the cause is failed attempts, a block by the administrator, an expired subscription or a suspicious sign-in.
2. Check whether only one account is affected or all at once. If all at once, the cause is usually the subscription or licence, not the single account.
3. Have someone with admin rights look in the Microsoft 365 admin portal: is sign-in blocked, is a licence assigned, is the subscription paid?
4. If you suspect outside access: change the password from a clean device, end all sessions, set up two-factor sign-in and check mailbox rules for secret forwarding.
5. If nobody with admin rights can be reached, get help: the task is then to prove administration of the tenant, which takes documents and time.

What not to do now

• Do not try passwords several times in a row: every failed attempt can extend the lock.
• Do not delete the account and create a new one, because the mailbox and data are tied to it.
• Do not buy a new subscription before it is clear whether the old one was merely unpaid.

More in our guides (in German): Microsoft-365-Konto gesperrt — was jetzt zu tun ist

Email does not work (sending or receiving)

Outlook shows an error, mails stay in the outbox or nothing arrives any more.

The first steps

1. Check whether the internet connection is up and whether only one mailbox or all are affected.
2. Photograph the Outlook message and open the mailbox in a browser. If it works there, the problem is the program or profile, not the account.
3. Check whether the mailbox is full or the password was changed recently: phones and other devices need the new password.
4. Do not delete mails in the outbox. For urgent customer mails, note the subject so nothing gets lost.
5. Get help if several mailboxes are affected or something was changed on the domain or the plan.

What not to do now

• Do not uninstall and reinstall Outlook before it is certain the mails are on the server.
• Do not delete or move mailbox files.
• Do not send the same mail several times: recipients would receive it twice.

More in our guides (in German): Outlook oder E-Mail geht nicht — was Sie zuerst selbst prüfen können

A workstation PC does not start

The screen stays black, Windows does not reach the sign-in or the computer keeps restarting.

The first steps

1. Check power supply, power strip and monitor cable; is the monitor on and the right input selected?
2. Unplug USB sticks and external drives and restart once more.
3. Photograph the message on the screen and note any beep codes or lights on the device.
4. Clarify whether important files are on the server or in the cloud or only on this computer: that decides how urgent the computer itself is.
5. Set up a substitute workstation so work continues, and get help.

What not to do now

• Do not switch it off and on repeatedly while Windows is showing updates or a repair.
• Do not remove the hard drive or reinstall Windows before the data is backed up.
• Do not run repair programs from the internet.

More in our guides (in German): Der Rechner ist langsam — woran es meistens wirklich liegt

Files are encrypted (ransomware)

Files no longer open, have new extensions, or there is a text file with a ransom demand in the folder.

The first steps

1. Disconnect affected computers and servers from the network at once — pull the cable or switch off Wi-Fi. Do not power off.
2. Check all other devices on the same network: are files affected there too? When in doubt, disconnect them as well.
3. Physically disconnect the backup immediately if it is attached to the network — otherwise it gets encrypted too.
4. Photograph the screen: ransom note, file extensions, time. That is evidence and helps with attribution.
5. Get help and report the incident — where personal data is involved, a 72-hour deadline for notifying the data protection authority starts running.

What not to do now

• Do not pay before somebody has checked the backup — in most cases recovery is possible.
• Do not run decryption tools from the internet; a large share of them is malware itself.
• Do not reinstall the affected devices before the cause is known — otherwise it happens again.

More in our guides (in German): Was muss eine kleine Firma bei der IT-Sicherheit wirklich tun? · Woran erkennt man, ob die Datensicherung wirklich funktioniert?

Server emergency: server down, what first?

In a server emergency, first check whether all workstations are affected or only one, then check power and the network connection, and do not restart anything before somebody has seen the state. Do not swap or pull out drives. If the server does not come back by itself, call before anyone restarts it: help by remote maintenance costs €95 per hour, without a contract. Typical signs: nobody can reach the data, the ERP system will not start, network drives have disappeared.

The first steps

1. Establish the scope: does it affect all workstations or only one? Is the network as a whole affected?
2. Look at the server without changing anything: is it running? Are fault lights on? Is there a message on the screen?
3. Check power and network connection — surprisingly often it is a plug or the uninterruptible power supply.
4. Do not restart anything before somebody has seen the state. A restart can clear error messages needed for diagnosis.
5. Get help and in parallel work out which work can continue without the server for now.

What not to do now

• Do not swap or pull out drives — in a RAID set that can destroy the last intact state.
• Do not restart repeatedly; with failing hardware that makes the damage worse.
• Do not start a restore without first checking how old the backup is.

More in our guides (in German): Was kostet ein Serverausfall — und wie rechnet man das aus?

A mailbox has been taken over

Mail goes out from your address that nobody wrote, or clients report strange messages with you as sender.

The first steps

1. Change the password of the affected account at once — from another, clean device.
2. End all signed-in sessions (one click in Microsoft 365 and Google Workspace).
3. Enable two-factor sign-in if it is not already on. Without it the new password is gone just as quickly next time.
4. Check forwarding and mailbox rules: attackers almost always create an inconspicuous rule that quietly redirects replies.
5. Warn recipients who may have received affected messages — especially where invoices carry changed bank details.

What not to do now

• Do not simply delete the account — that also removes the logs showing what happened.
• Do not reply to the fraudulent messages or open links in them.
• Do not release any payment arising from that correspondence before it is confirmed by phone.

More in our guides (in German): Phishing-Mails erkennen: fünf Merkmale, die immer stimmen

A laptop or phone is gone

A device with company data has been lost or stolen — on a train, in a car, on a building site.

The first steps

1. Check whether the device is managed: then it can be locked and wiped remotely. That is the most important step and takes minutes.
2. Change the passwords of the accounts that were signed in on the device — email first, then everything attached to it.
3. End that device's signed-in sessions in all services.
4. Record what was on the device: client data, personnel data, credentials. Whether a notification duty applies depends on it.
5. In case of theft file a police report and document the incident internally, with time and affected data.

What not to do now

• Do not wait to see whether it turns up — a lock can be undone, lost time cannot.
• Do not assume a login password is enough: without disk encryption it is bypassed in minutes.
• Do not leave the incident unreported where personal data is involved.

Internet, Wi-Fi or printer are down

Nobody can get online, the Wi-Fi has disappeared, or the printer no longer prints and cannot be found on the network.

The first steps

1. Check how far it reaches: are all devices affected or just one, and does it work over a network cable when the Wi-Fi does not?
2. Look at the router and switch: are they on, are the lights lit, are the cables plugged in? Only then unplug the router from power once, wait a minute and plug it back in.
3. For the printer: is it switched on and is there a message on its display? Photograph the message and open the print queue on the PC without deleting anything.
4. Write down what was changed last: an update, a new device, a refit, a change of provider. That is usually the shortest route to the cause.
5. If the internet is down for everyone, check the internet provider's outage notice: sometimes the fault is not in the building.

What not to do now

• Do not reset the router to factory settings: the access data and settings are gone afterwards.
• Do not move cables around at random without noting what was plugged in where.
• Do not delete and reinstall the printer driver repeatedly before the queue and the message on the device have been checked.

More in our guides (in German): Der Drucker im Büro druckt nicht — die fünf häufigsten Ursachen · Warum bricht das WLAN im Betrieb zusammen, obwohl die Leitung schnell ist?

Suspected phishing: someone clicked

An email looked genuine, and an employee clicked a link, opened an attachment or entered a password.

The first steps

1. Do not click anything else. Do not delete the email; note sender, subject and time, ideally as a photo of the screen.
2. If a password was entered: change it right away from another, clean device, and everywhere else the same password is used.
3. If an attachment was opened or something was installed: disconnect the device from the network (pull the cable, switch Wi-Fi off) but do not switch it off.
4. Warn the colleagues who received the same email so nobody follows the link.
5. If money was transferred or bank details were changed: call the bank immediately. The sooner, the more likely a payment can still be stopped.

What not to do now

• Do not reply to the email and do not use any “unsubscribe” links in it.
• Do not carry on as if nothing had happened if a password was entered.
• Do not blame anyone: the faster a mistake is reported, the smaller the damage stays.

More in our guides (in German): Phishing-Mails erkennen: fünf Merkmale, die immer stimmen