OneDrive Restoration stuck at 52% after Ransomware attack

Question

OneDrive Restoration stuck at 52% after Ransomware attack

Tammy Kaier 20

Hi,

I have been trying to restore my entire OneDrive account and it has been stuck at 52% for several hours. I have unliked all of my devices and reimaged them. I am using my sons Windows 11 computer to login via the web interface to complete the restoration before I relink my reimaged devices. Any idea why it is stuck and what I can do? I have rebooted (btw), and tried both Chrome and Edge web browsers. I am not syncing to this device, simply restoring my OneDrive account.

Thanks,

Tammy

Tammy Kaier 20 Reputation points

2026-05-28T16:50:29.1033333+00:00

Ultimately, I needed to let it run overnight.

Answer accepted by question author

AI answer

Ransomware-related OneDrive restores can take a long time and may appear stuck, especially when many files were deleted, overwritten, or encrypted. The behavior described (staying at 52% for several hours) typically indicates that the bulk restore operation is still processing in the service rather than a client/browser issue, particularly since different browsers and a different device have already been tried.

For large-scale corruption or ransomware scenarios, the supported path is:

Ensure all devices are fully cleaned or reimaged before reconnecting
- Follow the OneDrive ransomware flow: on the Clean all your devices screen, use antivirus to clean every device that uses OneDrive, or reset/reimage devices if antivirus cannot clean them.
- Only after all devices are clean or reset should the restore be completed, otherwise restored files can be re-encrypted.
Use the built-in OneDrive restore mechanism and let it run
- Go to the OneDrive website and use Settings > Options > Restore your OneDrive.
- For ransomware, the detection flow automatically selects the suggested date/time of the attack.
- Large restores (many files or extensive activity history) can take many hours; the UI may appear stuck at a percentage while the backend continues processing.
If the restore appears stalled for an extended period
- Verify that the restore was initiated from the OneDrive web experience as described in the documentation, not via sync.
- Do not reconnect any sync clients or devices until the restore completes.
- If the progress indicator does not move for a prolonged period (for example, many hours or longer than a day) and files are not reappearing, this falls into the “many files deleted/overwritten/corrupted or infected by malware” scenario where direct support assistance is recommended.
Escalate to Microsoft support if needed
- When many OneDrive files are affected and the standard restore process does not complete, the guidance is to contact Microsoft 365 support.
- Provide as much detail as possible, including:
  - Confirmation that devices have been cleaned or reimaged.
  - Approximate time/date of the ransomware event.
  - That a full OneDrive restore was started and is stuck around 52%.

Until support confirms otherwise, avoid starting another restore or reconnecting sync clients, as that can introduce additional activity into the history that the restore process must handle.

References:

AI-generated content may be incorrect. Read our transparency notes for more information.

1 additional answer

Your answer

Tammy Kaier 20 Reputation points

2026-05-28T16:50:29.1033333+00:00

Ultimately, I needed to let it run overnight.

Answer 1

Hi, Tammy Kaier

That 52% mark may not mean the browser is frozen. With ransomware restores, OneDrive can get caught on a batch of files, especially if the selected restore point still includes encrypted versions or if the restore history is very large.

Besides the solutions provided by the Q&A Assist, here are some suggestions you can try:

First, open OneDrive in another private/InPrivate browser window and check a few folders, the Recycle Bin, and Recent activity. If files are still appearing or changing, I would avoid restarting the restore again, because starting multiple restores can make the history harder to untangle.

If nothing is changing at all, it is recommended that you try restoring from a slightly earlier point than the ransomware detection time, if OneDrive gives you that option. Use Custom date and time and choose a point just before the first suspicious rename, encryption, or mass change. If the custom picker behaves strangely, try one of the preset restore points instead.

For the most important files, don’t rely only on the full restore. Go to OneDrive on the web, find a critical file, then check Version history and restore a clean older copy manually. Also check the OneDrive Recycle Bin, since files created after the restore point may be moved there during restore.

Before reconnecting any computer, download a few recovered files from the web and confirm they actually open. If the restore remains frozen and no files are recovering, contact Microsoft Support and ask them to check the backend OneDrive restore job, not the local sync client. Provide the stuck percentage, restore start time, ransomware date/time, and confirm that no device is currently syncing.

Please be advised that this is a user-to-user support forum. Moderators and contributors, including external Microsoft employees, are not allowed to directly interfere with Microsoft product features or access back-end systems. Our role is limited solely to providing technical guidance on reported incidents, requests, or ideas.

Thank you for your patience in reading, I hope this information has been helpful to you.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment."

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Kai-H 27,480 Reputation points Microsoft External Staff Moderator

2026-05-27T07:09:26.65+00:00

Hi, Tammy Kaier

It has been a while and I am writing to see how things are going with this issue.

Have you had a chance to check the replies provided?

Any update would be appreciated.
Tammy Kaier 20 Reputation points

2026-05-28T16:48:27.2766667+00:00

Once you validated you have ransomeware, One Drive does not allow you to inspect your folders or files.
Kai-H 27,480 Reputation points Microsoft External Staff Moderator

2026-06-01T06:16:57.28+00:00

Hi, Tammy Kaier

Thanks for clarifying. If OneDrive has already moved you into the ransomware recovery flow, then the normal “check folders/files first” advice may not apply, because OneDrive can restrict normal browsing once the infected-files path has been confirmed.

At that point, I would stay inside the ransomware recovery flow rather than trying to browse files normally. Use the restore screen’s activity chart or activity list, if it is still available, to choose a point before the first suspicious activity. The activity view is meant to help identify unusual file activity and select what needs to be undone.

If the restore is stuck and you cannot inspect anything, I would not start linking devices back yet. Also avoid making new changes in OneDrive while the restore is in progress. Changes should not be made until the restore finishes.

If the restore job remains stuck and the account is effectively locked into the ransomware flow, this is probably no longer something you can fix from the browser side. At that stage, I would contact Microsoft Support and word it very specifically: “OneDrive ransomware recovery flow is stuck at 52%, and after confirming infection I cannot access folders/files to verify recovery.” Ask them to check the server-side restore job, not the sync app.