Restore a File in Acronis EDR

Introduction

Acronis EDR automatically isolates suspicious files in a secure quarantine folder to prevent the spread of malware across your Nexcess servers. However, legitimate files or custom scripts are sometimes flagged as false positives. Restoring a quarantined file allows you to safely return trusted software to its original location so your applications can function normally. This solves unnecessary downtime caused by strict behavioral detection rules.

---

Prerequisites

Before managing or deploying templates, ensure you have:

• Nexcess Portal Permissions: You must have access to the Nexcess portal with an Owner or Technician role to view server management options and use the SSO authentication into the Acronis portal.
  
• Verification: You must independently verify that the quarantined file is absolutely safe and not a genuine threat.

---

Step-by-step Instructions

Follow these steps to restore a trusted file from quarantine:

1. First, log in to your Nexcess portal. Next, navigate to the Security tab in the left-hand menu.
   
2. Under the Quarantine Queue, you should see the file in question. If you see the file, select the See all in Acronis to authenticate automatically and SSO into the Quarantine section of the Acronis portal.
   
3. Locate and select the specific file you want to recover. You can use the filters and search functions, if needed.
   
4. Click the file you need to pull out a drawer off the right side that contains more information about the file. Confirm the file path to ensure only legitimate files are restored.
   
5. Click Restore to return the file to its original location.
   
6. Alternatively, click Add to allowlist if you want to permanently whitelist the file’s signature and prevent Acronis from quarantining other files that have the same signature during future scans.

---

Troubleshooting and FAQs