Direct answer
Recover under the incident team's plan: contain and investigate, choose a trusted rebuild or repair path, restore approved data, protect affected accounts and verify the device before reconnecting it.
Coordinate before cleanup
Confirm the device, owner, suspected scope and incident lead. Preserve required evidence and understand whether other systems or credentials may be affected. Deleting an alert or running a scan does not by itself establish that the attacker is gone.
Choose a trusted recovery path
The response team should decide whether to rebuild from trusted media, restore from a verified backup or use another approved procedure. Check that the backup predates the incident where possible, and scan or inspect restored data under the organization's process. Reset affected credentials through trusted systems.
Verify before return
Confirm required updates, endpoint protection, management enrollment and approved applications. Test normal workflows and monitoring, document residual risk and obtain the owner's release decision. Microsoft describes response and investigation actions for supported managed devices; available actions depend on the deployment.
Reference: Microsoft: Investigate devices and response actions.
Check the identity and data dependencies
A rebuilt laptop may still reconnect to a compromised account or restore unsafe content. Before return, coordinate session revocation and credential recovery with the identity team, then validate the selected backup and required applications. Record what evidence was retained and what the team could not establish about the initial intrusion.
Assessment limits
Recovery depends on incident scope, evidence and business requirements. A clean scan alone does not prove complete removal or account safety.
Frequently asked questions
Does a successful scan prove the device is clean?
No. Use the incident team's broader recovery and verification criteria.
Can an old backup contain the same compromise?
Yes. Assess backup age, integrity and restoration risks before relying on it.
Should credentials be reviewed after endpoint compromise?
Yes. The response team should determine which accounts and sessions could have been exposed.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.