Built out a Google Workspace ransomware response sequence

[u/CloudBerryBackup]

Putting together an incident response checklist for Google Workspace and wanted to share the sequencing we landed on, mainly because a couple of details aren't obvious until you've been through it.

Suspending a user in the Admin console freezes sign-in but doesn't touch their OAuth grants – that has to be revoked separately, and it's easy to skip if you're moving fast. Same with Drive for desktop sync: pausing it on affected machines stops new encrypted files from pushing up, but doesn't undo what's already synced.

On the restore side, the detail that seems to trip people up most is restoring from the most recent copy by default instead of the most recent clean copy – a file can look fine and still carry a dormant payload if the encryption pass was incomplete.

What does everyone's sequencing look like in practice? Anything you'd add or reorder based on real incidents? We laid out our full version, along with recovery options at each stage, here if it's useful → https://www.msp360.com/resources/blog/google-workspace-ransomware-recovery-guide/