How to set up and manage automatic backups to a USB drive that only connects on a schedule to protect against ransomware

Summary

This guide helps you troubleshoot and resolve: How to set up and manage automatic backups to a USB drive that only connects on a schedule to protect against ransomware. Follow the steps below to fix the issue.

Common Causes

Keeping backups offline is one of the strongest defences against ransomware. If your backup drive sits plugged in permanently, malicious software on your network can encrypt or delete those backups just as easily as your live data. By only connecting your USB drive during a short, scheduled backup window, you dramatically reduce the window of opportunity for ransomware to reach it.

This guide walks you through setting up a scheduled backup that runs while the drive is connected, then safely disconnects the drive when the job is finished. The approach works on both Windows and macOS and does not require any paid software.

How the Scheduled Offline Backup Approach Works

The concept is straightforward:

• You set a recurring backup window (for example, every weekday at 11pm).
• At the start of that window, you connect the USB drive.
• The backup software runs automatically.
• When the backup finishes, the software ejects the drive and you unplug it.
• The drive spends the rest of the day offline, invisible to ransomware.

What You Will Need

• A USB drive or external HDD with enough capacity for your data. We recommend a drive dedicated solely to backups.
• A computer running Windows 10/11 or macOS 12 or later.
• Built-in backup tools (File History on Windows, Time Machine on macOS) or a third-party tool such as Veeam Agent Free, Duplicati, or Arq.
• A small calendar reminder or scheduled task to physically plug the drive in at the right time.

Quick Fix Steps

1. Prepare and label your USB backup drive.
2. Configure your backup software to run on a schedule.
3. Set the software to eject the drive when finished.
4. Create a recurring reminder to plug the drive in before the backup window.
5. Test the full cycle end-to-end.

Detailed Instructions

Step 1: Prepare the Backup Drive

1. Connect the USB drive to your computer.
2. Open Disk Management on Windows (right-click the Start button and choose Disk Management) or Disk Utility on macOS (Applications > Utilities > Disk Utility).
3. Format the drive as NTFS (Windows) or APFS (macOS) and give it a clear label such as OFFLINE-BACKUP.
4. Eject the drive safely.

Step 2: Configure File History on Windows

1. Connect the USB drive.
2. Open Settings > Update & Security > Backup (Windows 10) or Settings > System > Storage > Advanced storage settings > Backup options (Windows 11).
3. Click Add a drive and select your USB drive.
4. Click More options to set the backup frequency (for example, Every 1 hour) and how long to keep backups.
5. Under Back up these folders, add or remove folders to match what you need to protect.
6. Click Back up now to perform an initial backup.

Step 3: Configure Time Machine on macOS

1. Connect the USB drive.
2. Open System Settings > General > Time Machine.
3. Click Add Backup Disk and select your USB drive.
4. Choose Set Up Disk and decide whether to encrypt the backups (recommended).
5. Time Machine will begin its first backup automatically. Subsequent backups run hourly when the drive is connected.

Step 4: Use a Third-Party Backup Tool (Optional but Recommended)

Built-in tools are good, but dedicated backup software gives you more control over scheduling and post-backup actions. Tools we commonly recommend include:

• Veeam Agent for Windows (Free) — supports scheduled jobs, retention policies, and post-backup scripts.
• Duplicati — cross-platform, supports encrypted backups to local USB.
• Arq Backup — paid, but excellent for macOS with strong encryption.

Whichever tool you choose, configure it to:

1. Run only during your defined backup window.
2. Verify the backup after writing.
3. Execute a post-backup command to eject the drive.

Step 5: Automate Ejection of the USB Drive

On Windows using a Scheduled Task

1. Open Task Scheduler (search for it from the Start menu).
2. Click Create Task (not Create Basic Task) for more control.
3. Give it a name such as Eject Backup Drive.
4. On the Triggers tab, create a new trigger that runs Daily at the time you want the backup to finish (for example, 11:30pm).
5. On the Actions tab, choose Start a program and enter: powershell.exe
6. In the Add arguments field, enter: -Command "(New-Object -COMObject Shell.Application).NameSpace(17).ParseName('E:').InvokeVerb('Eject')"
7. Replace E: with the actual drive letter of your USB drive.
8. Click OK and test the task by right-clicking it and choosing Run.

On macOS using a launchd script

1. Open Terminal (Applications > Utilities > Terminal).
2. Create a script file with: nano ~/eject-backup.sh
3. Add the following line, replacing OFFLINE-BACKUP with your drive label:

   diskutil unmount /Volumes/OFFLINE-BACKUP

4. Save with Ctrl+O, then exit with Ctrl+X.
5. Make the script executable: chmod +x ~/eject-backup.sh
6. Create a launchd plist file to schedule the script. Open Terminal and run: nano ~/Library/LaunchAgents/com.local.eject-backup.plist
7. Add the following content, replacing yourusername with your actual macOS username:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
   <plist version="1.0">
   <dict>
       <key>Label</key>
       <string>com.local.eject-backup</string>
       <key>ProgramArguments</key>
       <array>
           <string>/Users/yourusername/eject-backup.sh</string>
       </array>
       <key>StartCalendarInterval</key>
       <dict>
           <key>Hour</key>
           <integer>23</integer>
           <key>Minute</key>
           <integer>30</integer>
       </dict>
   </dict>
   </plist>

8. Save with Ctrl+O, then exit with Ctrl+X.
9. Load the launchd job with: launchctl load ~/Library/LaunchAgents/com.local.eject-backup.plist

Step 6: Create a Reminder to Plug the Drive In

1. Open your calendar app (Outlook, Google Calendar, or Apple Calendar).
2. Create a recurring event titled Plug in backup drive.
3. Set it to repeat on the days you want backups (for example, weekdays).
4. Set the reminder to alert you 5 minutes before the backup window starts.

Step 7: Test the Full Cycle

1. Plug in the drive at the scheduled time.
2. Wait for the backup to run and complete.
3. Confirm the drive was ejected automatically.
4. Reconnect the drive and verify the backup files are present and readable.
5. Test restoring a single file from the backup to confirm it works correctly.
6. Check your backup software logs to confirm no errors occurred.

Troubleshooting

• Backup fails silently: Check that the drive is connected before the backup window starts. Review your backup software's log files for error details.
• Drive does not eject: Close any open File Explorer or Finder windows showing the drive contents, then try ejecting manually.
• Scheduled task does not run: Open Task Scheduler, find your task, and check the History tab. Ensure the computer is awake at the scheduled time, or enable Wake the computer to run this task in the task's Conditions settings.
• macOS launchd job does not run: Verify the plist file is loaded with launchctl list | grep eject-backup. Check Console.app for any error messages related to your script.

Still Having Issues?