Google Drive Ransomware Detection: How Admins Turn It On and How Users Restore Files

Last checked Nov 10, 2026. Picks are based on the prices, rates, fees and terms each provider publishes, checked at the source. We never rank products by commission. See how we’re funded.

Google Drive ransomware detection is a Drive for desktop safeguard that pauses file syncing when it sees signs of encryption, and Drive file restoration is the companion tool that rolls many files back to an earlier version. Google announced general availability on March 30, 2026 in a Workspace Updates post, and it describes the admin settings on a Workspace admin page. Drive’s own Help page covers the user steps. This guide explains how Google Drive ransomware detection works, how an administrator turns it on, how a user restores files, and where Google’s three pages disagree.

How Google Drive ransomware detection works

Google says the feature scans files as they sync from a computer to Drive. When it finds encrypted files, Drive for desktop pauses syncing, so the encrypted copies stop overwriting good versions in the cloud. The user receives an email and a Drive notification, and the administrator sees an alert in the Admin console. The March post says the detection model finds 14 times more infections than the beta version did and recognizes more types of ransomware encryption, but it gives no accuracy figures beyond that comparison.

Which accounts get Google Drive ransomware detection

Google Drive ransomware detection is tied to the Workspace edition, and restoration reaches more accounts. The two Google pages list the editions differently, as the table shows.

How an administrator turns on Google Drive ransomware detection

Google Drive ransomware detection is on by default, so most organizations only need these steps to confirm the setting or to change it for one organizational unit. The steps below come from the admin page.

1. In the Admin console, open the menu and select Apps, then Google Workspace, then Drive and Docs.
2. Select Malware and Ransomware, then Ransomware detection.
3. Choose On or Off and select Save.
4. To control restoration, select Drive file restoration, set Allow multiple file version recovery to On, and select Save.
5. Install Drive for desktop 114 or later on user computers so that alerts appear.

Both the Google Drive ransomware detection setting and the restoration setting can be applied at the organizational unit level, so a team that handles sensitive files can be treated differently from the rest. End-user availability depends on the choices the administrator makes.

What users see when Google Drive ransomware detection fires

A user whose files trigger Google Drive ransomware detection gets an email and a Drive notification, and syncing from that computer stops. Google’s admin page says a user who is sure a file is safe can select I recognize this file, which turns detection off for that user for 24 hours. The page does not say what Drive does if the same user is flagged again after the 24 hours end. Administrators should expect an alert in the Admin console as well, and the March post calls the location both the Alert center and the security center.

How to restore files after a ransomware attack

Drive’s Help page labels the restore tool as a beta feature. It keeps 25 days of revisions, so only files changed within the past 25 days can be restored. The page gives these steps for a user:

1. Go to drive.google.com and open Settings.
2. Select Restore file versions and review the change history.
3. Select the version to return to, then select Restore.

The tool restores many files at once, because Google says individual files cannot be picked, and only one restore can run at a time. Google Docs, Sheets, and Slides files do not appear in the tool, and no versions are deleted by a restore. Google’s recovery tips for a ransomware case add an order of operations: sign out of Drive for desktop, restore from the oldest encrypted change, remove the malware, clean up the encrypted local copies, and then sign back in.

Where Google’s pages disagree

The March post lists Enterprise Starter as an edition with Google Drive ransomware detection, and the admin page does not. The March post also announces both features as generally available and gives no restore time limit, while the Help page marks restoration as beta and states the 25-day window. Neither the post nor the admin page names the operating systems that Drive for desktop must run on. A reader who plans a rollout can check the edition list and the restore window against the admin page for their own tenant.

Jolt Journal’s checklist

These steps are the Jolt Journal’s own suggestions and are not Google’s instructions.

1. Confirm the version of Drive for desktop on each computer, since Google Drive ransomware detection pauses syncing on versions older than 114 without showing an alert.
2. Check the Google Drive ransomware detection setting in the Admin console for each organizational unit, instead of assuming the default is untouched.
3. Decide who receives the Admin console alert, because only files changed within the past 25 days can be restored.
4. Keep a copy of important files outside Drive. The Jolt Journal’s guide to backing up a phone covers one path, and the Windows 11 Cloud Rebuild guide explains how a reinstalled PC gets its files and apps back.

Editor’s take

Google Drive ransomware detection works only where Drive for desktop is installed and current, and the restore tool works only inside a 25-day window and for files that are not native Google documents. That makes the feature a good safety net for synced folders and a poor substitute for a separate backup. Organizations that rely on it should test the restore steps once on a sample folder, so that nobody learns the menu path for the first time during an incident.

This is general information based on Google’s published pages. Editions, features, and limits can change, and Google’s own pages have the final word.