Could disconnecting a server affect other users or evidence?¶

Yes. Disconnecting a server can affect many users, services and sources of evidence at the same time.

Evidential caution: that isolating one physical machine affects only that machine. A server may host shared files, databases, authentication, email, virtual machines, applications, backups or security logging.

What this means¶

Disconnection may terminate active user sessions, interrupt transactions, stop central logs and remove access to systems that depend on it.

It may also prevent an attacker from continuing activity, which can protect the organisation but reduce visibility of the incident.

Before any action, identify the server’s role, owners, users, dependencies and current operational impact.

Consider whether other systems rely on the server for identity, storage, time, backup, monitoring or access control.

A single physical server may also host several virtual servers, so one disconnection can affect multiple evidential environments at once.

Consider whether a narrower action is available, such as isolating one interface, account, virtual machine or service.

Be honest about evidential consequences. If sessions ended, logs stopped, transactions failed or services became unavailable, document that directly.

What to check or do next¶

• Record displays, alerts, connections, active sessions and visible system identifiers.
• Do not disconnect a server merely because compromise is suspected. Incident-response, system-administration and forensic specialists should normally coordinate the decision.
• If immediate harm requires disconnection, record the decision factors, advice received, action taken and resulting impact.
• Record who authorised the action and how affected users or systems were identified afterwards.