How to Configure Windows Server File Classification Infrastructure (FCI) via PowerShell

The Data Governance Crisis

In a large enterprise, a single Windows File Server might hold 5 million files spanning terabytes of data. Scattered amongst those millions of standard Word documents and PDFs are highly sensitive files: spreadsheets containing employee Social Security Numbers, text files containing customer credit card numbers, and proprietary architectural blueprints.

If an administrator wants to enforce a security policy (e.g., “Encrypt all documents containing credit card numbers”), they have a fundamental problem: the server doesn’t know what is inside the files. It only knows file names and dates.

Microsoft solved this by introducing the File Classification Infrastructure (FCI) in Windows Server. FCI is an automated data governance engine. It crawls through millions of files during off-hours, opens the files, reads the internal text using Regular Expressions (Regex), and mathematically assigns metadata “tags” to the files. Once a file is tagged as “High Business Impact,” you can use PowerShell to trigger automated tasks: instantly encrypt the file via RMS, move it to a highly secure folder, or immediately email an alert to the IT Security team.

Step 1: Installing the FCI Role

FCI is a sub-component of the File Server Resource Manager (FSRM).

Open an elevated PowerShell session on your target File Server and install the roles:

Install-WindowsFeature -Name FS-Resource-Manager -IncludeManagementTools

Step 2: Defining the Classification Property

The first step is creating the metadata “tag” (the Property) that we will attach to the files.

Let’s create a Yes/No (Boolean) property called ContainsPII (Personally Identifiable Information).

New-FsrmClassificationPropertyDefinition -Name "ContainsPII" -Type YesNo -Description "Indicates if the file contains Social Security Numbers"

Step 3: Creating the Classification Rule

Now we must build the brain of the operation. We must tell FCI exactly how to determine if a file deserves the ContainsPII tag. We will use a built-in content classifier to search for the mathematical pattern of a US Social Security Number (XXX-XX-XXXX).

# Define the Regex for an SSN
$SSN_Regex = "\b\d{3}-\d{2}-\d{4}\b"

# Create the Rule
New-FsrmClassificationRule -Name "Detect SSNs" -Property "ContainsPII" -PropertyValue "Yes" -Namespace "D:\CorporateShares\Finance" -ClassificationMechanism "Content Classifier" -Parameters @("RegularExpression=$SSN_Regex")

Understanding the Command:

• -Namespace: This tells FCI to exclusively scan the Finance share on the D: drive, ignoring the rest of the server to save CPU cycles.
• -ClassificationMechanism: This invokes the deep-inspection engine, forcing the server to actually open the PDFs and Word docs to read the text.
• -Parameters: This injects our specific Regex pattern into the engine.

Step 4: Executing the Classification Scan

FCI usually runs on a scheduled task during the weekend. For our purposes, we will force it to run immediately and wait for the results.

Start-FsrmClassification -RunDuration 0 -Confirm:$false
Wait-FsrmClassification

The server will now aggressively scan the Finance folder. If it finds a single Social Security Number inside a file, it will physically write the ContainsPII = Yes metadata tag directly into the NTFS alternate data stream of that file.

Step 5: Enforcing the Automated Action

Now that the files are tagged, we must execute a security response. We will create a File Management Task that scans for any file tagged ContainsPII = Yes and automatically moves it to a highly secure quarantine folder.

# 1. Define the action (Move the file to the Quarantine folder)
$Action = New-FsrmAction -Type Custom -Command "cmd.exe" -CommandParameters "/c move [SourceFilePath] D:\SecureQuarantine\"

# 2. Define the condition (Only trigger if the ContainsPII tag is Yes)
$Condition = New-FsrmFileCondition -Property "ContainsPII" -Condition Equal -Value "Yes"

# 3. Create the management task
New-FsrmFileManagementTask -Name "Quarantine PII Data" -Namespace "D:\CorporateShares\Finance" -Action $Action -Condition $Condition -Schedule (New-FsrmScheduledTask -Time (Get-Date).AddMinutes(5))

The Zero Trust File Server

Your Windows Server is now a self-governing entity. If a Junior Accountant attempts to save a massive spreadsheet full of customer SSNs onto the public Finance network drive, they will succeed temporarily. But when the scheduled FCI scan runs at midnight, the server will open the spreadsheet, detect the Regex pattern, instantly tag the file, and immediately execute the CMD script to rip the file off the public share and drop it into a locked quarantine drive, preventing a massive data breach without requiring any human intervention.