The pattern: a laptop comes back from repair, or a user restores from an old backup, or resets OneDrive after "it was stuck". The client reconnects, compares its month-old copies to the library, decides the local ones are the truth, and uploads them. Two hundred files now have that user as Modified by and last month's content as the current version. Everyone else's edits are one version down.
Confirm the pattern
Library → sort by Modified. A block of files with the same Modified by and timestamps seconds apart is the signature. Open one → Version history: the top version is the stale upload, the one below is what everyone actually wanted.
Check the audit log if you need proof it was the sync client: FileModified events from that user with a ClientIP and user agent of the OneDrive client, in a burst.
Stop it first
Ask the user to pause syncing (OneDrive icon → Pause) or sign out of OneDrive on that device. If you restore before that, the client may see the restored version as "changed on the server", decide its local copy is still right, and do it again.
The one-file fix
Version history → ⋯ on the version before the burst → Restore. The restore is itself a new version; the stale upload is preserved one level down, so nothing is lost either way.
The two-hundred-file fix
Same loop as any "undo one account's changes after one moment":
Connect-PnPOnline -Url https://contoso.sharepoint.com/sites/Projects -Interactive
$who = 'r.smit@contoso.com'
$burst = Get-Date '2026-07-20 08:05' # first stale upload
$end = Get-Date '2026-07-20 08:20' # last one - keep the window tight so later real edits are untouched
Get-PnPListItem -List 'Documents' -PageSize 2000 -Fields FileRef,Modified,Editor |
Where-Object { $_['Editor'].Email -eq $who -and $_['Modified'] -ge $burst -and $_['Modified'] -le $end -and $_.FileSystemObjectType -eq 'File' } |
ForEach-Object {
$good = Get-PnPFileVersion -Url $_['FileRef'] | Where-Object Created -lt $burst | Sort-Object Created -Descending | Select-Object -First 1
Restore-PnPFileVersion -Url $_['FileRef'] -Identity $good.Id -Force
}
Keep the window tight: the burst is usually a few minutes, and if the same user made genuine edits an hour later you do not want to revert those. Files with no earlier version existed only on the laptop; the call fails on those, which is fine — they are probably wanted.
That is the 80% version. The checks that stop it restoring the wrong thing — showing you the list first, skipping files it should not touch, and confirming afterwards — are the part we built the tool for.
Why it keeps happening, and the fix that sticks
A team library synced in full to twenty laptops is twenty chances for exactly this. Microsoft's own guidance for shared libraries is Add shortcut to OneDrive, which shows the files in File Explorer but keeps the library as the source of truth, with Sync reserved for a couple of folders someone genuinely needs offline.
In the SharePoint admin centre you can also block sync for the library or site (Settings → Sync) and leave shortcuts as the only path.
The tool version
Filter by who, when, where and what type; dry run that shows restorable / no-prior-version / checked-out / created-after / already-current; type RESTORE. That is Rollback365, and it restores named versions so a wrong pick is just another version to restore from.