Defending Against Ransomware at the File Server Level
When a user’s workstation is infected with ransomware, the malware doesn’t just encrypt the local hard drive; it instantly maps the user’s network drives and begins encrypting corporate files on the server, appending known ransomware extensions (like .crypt, .locky, or .wnry). By leveraging the File Server Resource Manager (FSRM) role in Windows Server, you can actively screen network shares and instantly block anyone attempting to write these malicious extensions, stopping the infection in its tracks.
Step 1: Install the FSRM Role
Open Server Manager and launch the Add roles and features wizard. Expand File and Storage Services > File and iSCSI Services, and check the box for File Server Resource Manager. Complete the installation.
Step 2: Create a File Group for Ransomware
Open the File Server Resource Manager console from the Tools menu. In the left pane, expand File Screening Management and click on File Groups.
Right-click in the middle pane and select Create File Group…. Name it “Known Ransomware Extensions”. In the “Files to include” box, you will add the extensions associated with ransomware (e.g., *.crypt, *.locky, *.zepto, *.crypto). You can find comprehensive, updated lists of known ransomware extensions on GitHub to paste into this box. Click OK to save the group.
Step 3: Create a File Screen Template
Next, click on File Screen Templates in the left pane. Right-click and select Create File Screen Template….
Name the template “Block Ransomware”. Ensure the screening type is set to Active screening (do not allow users to save unauthorized files). In the list of file groups below, check the box next to the “Known Ransomware Extensions” group you just created.
Step 4: Configure Email Notifications (Optional but Highly Recommended)
While still in the template editor, switch to the E-mail Message tab. If you have an SMTP server configured in FSRM, you can configure an alert to immediately email the IT team when a user attempts to save a ransomware file. A great alert message is: “Warning: User [Source Io Owner] attempted to save a ransomware file [Source File Path] on server [Server]. Disconnect this user immediately!”
Step 5: Apply the File Screen to Your Shares
Finally, you must apply the template to your actual data drives. Click on File Screens in the left pane. Right-click and select Create File Screen….
Browse to the path of your shared folders (e.g., D:\CorporateData). In the “Derive properties from this file screen template” drop-down, select your “Block Ransomware” template. Click Create.
FSRM will immediately begin monitoring the file share. If an infected workstation attempts to write an encrypted file with a blocked extension to the server, the server will forcefully reject the write operation, saving your corporate data.