Save open work and back up important files. Use instructions for your exact device and software version. If Windows cannot start, see the startup guide.
Work through these checks
0 of 4 complete01Enable detailed PowerShell script block logging (Event ID 4104)
- Enable detailed PowerShell script block logging (Event ID 4104)
Check whether the original symptom still occurs.
If it does not helpContinue only if this check applies to your device. Consult its manufacturer if you are unsure.
02Perform a full audit of built-in system accounts and active sessions
- Perform a full audit of built-in system accounts and active sessions
Check whether the original symptom still occurs.
If it does not helpContinue only if this check applies to your device. Consult its manufacturer if you are unsure.
03Reset all administrative credentials and domain trust settings
- Reset all administrative credentials and domain trust settings
Check whether the original symptom still occurs.
If it does not helpContinue only if this check applies to your device. Consult its manufacturer if you are unsure.
04Decommission and replace compromised edge network routing hardware
- Decommission and replace compromised edge network routing hardware
Check whether the original symptom still occurs.
If it does not helpContinue only if this check applies to your device. Consult its manufacturer if you are unsure.
Possible causes
- Compromised edge devices (SOHO routers, firewalls, VPN appliances)
- Use of stolen administrative credentials
- Lack of command-line logging and network telemetry monitoring
Was this helpful?
Your progress is saved on this device.