The Ransomware Defense Layer
In a corporate file server environment, the primary D: drive (the central share) is a massive dumping ground for thousands of employees. Left unchecked, employees will use this expensive SAN storage to backup their personal iPhones, storing gigabytes of .mp3, .mp4, and .jpg files. Worse, if an employee’s computer is infected with ransomware, the malware will rapidly encrypt the network files, renaming them with extensions like .crypt or .locky, destroying the company’s data.
To proactively prevent this, Windows Server provides the File Server Resource Manager (FSRM). FSRM allows administrators to deploy File Screens. A File Screen intercepts every single file write attempt at the kernel level. If a user tries to save an .mp3 file, FSRM instantly blocks the write, returning an “Access Denied” error to the user, completely protecting the storage array.
While you can click through the FSRM GUI to build these screens, deploying them via PowerShell allows for rapid, scalable automation, particularly when deploying ransomware defense scripts.
Step 1: Installing the FSRM Role
FSRM is not installed by default. Open an elevated PowerShell session on your File Server and execute:
Install-WindowsFeature -Name FS-Resource-Manager -IncludeManagementToolsStep 2: Creating a File Group
A “File Group” is a logical collection of file extensions that you want to target. Instead of making a rule for just .mp3, you create a group called “Audio/Video” and add all multimedia extensions to it.
To create a custom group targeting known ransomware extensions, execute:
New-FsrmFileGroup -Name "Known Ransomware Extensions" -IncludePattern @("*.crypt", "*.locky", "*.zepto", "*.cerber")Step 3: Creating the File Screen Template
A “Template” defines what action to take when a file matches the group. Should it just log a warning (Active: False), or should it aggressively block the file (Active: True)?
Execute the following to create an active blocking template based on the group we just created:
New-FsrmFileScreenTemplate -Name "Block Ransomware" -IncludeGroup "Known Ransomware Extensions" -Active $trueStep 4: Applying the File Screen to a Volume
Finally, you must apply the template to a specific directory or the entire drive. If your corporate share is located at D:\Shares\Corporate, you bind the template to that path.
New-FsrmFileScreen -Path "D:\Shares\Corporate" -Template "Block Ransomware"The screen is instantly active. If any user, script, or malware attempts to write a file named financials.xlsx.crypt into that folder, the Windows kernel will physically deny the write operation.
Step 5: Configuring Email Alerts (Optional but Critical)
Blocking the ransomware is excellent, but the IT department needs to know that an attack is actively occurring so they can isolate the infected laptop.
You can configure FSRM to automatically dispatch an SMTP email the moment a screen is triggered.
$Action = New-FsrmAction -Type Email -MailTo "[email protected]" -Subject "Ransomware Activity Detected!" -Body "User [Source Io Owner] attempted to write a restricted file [Source File Path] on [Server]." -RunLimitInterval 5
Set-FsrmFileScreenTemplate -Name "Block Ransomware" -Notification $ActionWith this configuration, FSRM acts as both a bulletproof shield against unauthorized file types and an early-warning intrusion detection system for your data center.