How to Configure Windows Server File Server Resource Manager (FSRM) for Ransomware Protection

The Ransomware Threat on File Servers

Corporate file servers are the primary target for ransomware operators. If a user clicks a malicious link in an email, the ransomware payload executes on their workstation and immediately begins scanning the network for mapped drives. Within minutes, the ransomware traverses the SMB connection and encrypts every PDF, Word document, and Excel spreadsheet on the central Windows Server file share, appending proprietary extensions like .locked or .crypt to the filenames.

While having robust, offline backups is the ultimate fail-safe, restoring terabytes of data takes days. IT administrators need a proactive mechanism to detect a ransomware infection the second it begins encrypting files and immediately sever the compromised user’s connection to the server.

This can be achieved using a built-in, but often underutilized, Windows Server feature: File Server Resource Manager (FSRM).

Step 1: Installing FSRM

FSRM is a suite of tools designed to manage and classify data stored on file servers. It includes quotas, file screening, and storage reports.

To install it, open an elevated PowerShell prompt on your file server:

Install-WindowsFeature -Name FS-Resource-Manager -IncludeManagementTools

Once installed, open the File Server Resource Manager console from the Administrative Tools menu.

Step 2: Understanding File Screens

FSRM’s primary defense mechanism is the File Screen. A File Screen actively monitors a specific directory and blocks users from saving files that match a defined pattern (e.g., blocking *.mp3 files from the accounting share).

To use this against ransomware, we invert the concept: instead of blocking music files, we create a massive list of known ransomware extensions and block them. When the ransomware attempts to rename Financials.xlsx to Financials.xlsx.locked, FSRM intercepts the disk write, blocks the action, and triggers an immediate alert.

Step 3: Creating the Ransomware File Group

First, we must define the extensions.

1. In the FSRM console, expand File Screening Management and click on File Groups.
2. Right-click and select Create File Group.
3. Name it “Ransomware Extensions”.
4. In the “Files to include” box, you must add the extensions used by ransomware strains (e.g., *.crypto, *.locked, *.zepto, *.cryptowall).

Note: Because thousands of ransomware variants exist, manually typing them is impossible. Administrators should use a PowerShell script (readily available on GitHub) to pull the latest list of known ransomware extensions from a community-maintained API (like fsrm.experiant.ca) and automatically inject them into the FSRM File Group.

Step 4: Configuring the Alert and Action (The Kill Switch)

Blocking the file write is only half the battle. If a machine is infected, it will rapidly try thousands of files. We must configure FSRM to take immediate action the second the first block occurs.

1. In FSRM, navigate to File Screen Templates. Right-click and Create File Screen Template.
2. Name it “Ransomware Defense Template”.
3. Set the screening type to Active screening (do not allow users to save unauthorized files).
4. Select your “Ransomware Extensions” file group.

Now, configure the responses:

• Email Message tab: Configure an immediate high-priority email to the IT Helpdesk alerting them that a specific user (using the [Source Io Owner] variable) has triggered the ransomware screen.
• Event Log tab: Check the box to send a warning to the Windows Event Log (critical for SIEM ingestion).
• Command tab (Crucial): Check the box to run a command or script. We want to execute a PowerShell script that instantly revokes the infected user’s SMB access.

Step 5: Creating the Automated Response Script

When FSRM detects a hit, it will execute a script. You must write a small PowerShell script (e.g., C:\Scripts\Kill-SMBShare.ps1) that accepts the username as an argument.

The script should use the SmbShare module to instantly close all active SMB sessions belonging to that specific user:

param([string]$Username)
# Remove domain prefix if present
$User = $Username.Split("\")[-1]

# Find and forcefully close all open SMB sessions from the infected user
Get-SmbSession | Where-Object {$_.ClientUserName -match $User} | Close-SmbSession -Force

In the FSRM Command tab, point the executable to powershell.exe and pass the script path and the FSRM user variable as arguments:

-ExecutionPolicy Bypass -File "C:\Scripts\Kill-SMBShare.ps1" -Username "[Source Io Owner]"

Step 6: Applying the File Screen

Finally, navigate to File Screens, right-click, and select Create File Screen. Point it to your root data drive (e.g., D:\Shares) and apply the “Ransomware Defense Template”.

Conclusion

By leveraging FSRM, administrators transform passive file servers into active defense nodes. The moment ransomware attempts to write a known malicious extension, the server blocks the write, alerts the IT team, and automatically severs the infected workstation’s connection, isolating the threat and saving terabytes of corporate data from encryption.