How to Use Windows Server FSRM (File Server Resource Manager) to Block Specific File Extensions

If your company has a shared network drive (e.g., \\Server1\Marketing), it doesn’t take long for it to become a dumping ground. Employees will use the expensive enterprise SAN storage to back up their personal iPhones, storing gigabytes of .mp4 videos, .mp3 music files, and even .exe game installers. Not only does this waste expensive storage and increase backup times, but allowing executables on a file share is a massive security risk for ransomware. To stop this behavior at the server level, you must configure File Server Resource Manager (FSRM) to actively block specific file extensions.

What is FSRM?

FSRM is a suite of tools built into Windows Server that allows administrators to classify data, set hard storage quotas, and create File Screens. A File Screen intercepts write requests at the file system filter driver level. If a user tries to drag and drop an .mp3 file into the shared folder, FSRM instantly rejects the operation, and the user receives an “Access Denied” error, exactly as if they lacked NTFS permissions.

Step 1: Install FSRM

FSRM is not installed by default on Windows Server.

1. Open Server Manager.
2. Click Manage > Add Roles and Features.
3. Expand File and Storage Services > File and iSCSI Services.
4. Check the box for File Server Resource Manager.
5. Click Install. (A reboot is usually not required).

Step 2: Create a File Group

Before you can block files, you need to define what to block by creating a File Group.

1. Open the File Server Resource Manager console from the Tools menu in Server Manager.
2. In the left pane, expand File Screening Management and click File Groups.
3. Microsoft includes several default groups (like “Audio and Video Files” and “Executable Files”).
4. To create a custom group, right-click File Groups and select Create File Group.
5. Name it “Blocked Personal Files”.
6. In the “Files to include” box, type the extensions you want to ban, pressing Add after each one (e.g., *.mp3, *.mp4, *.iso, *.torrent).
7. Click OK.

Step 3: Create a File Screen Template

Next, you create a template that tells FSRM what to do when it detects those files.

1. Click File Screen Templates in the left pane.
2. Right-click and select Create File Screen Template.
3. Name the template “Block Personal Media”.
4. Under Screening type, ensure Active screening is selected (this actually blocks the file; Passive screening only logs the attempt).
5. In the list of File groups, check the box next to your new “Blocked Personal Files” group.
6. Optional: Go to the Event Log tab and check the box to generate a warning in the Windows Event Viewer whenever someone tries to save a blocked file.
7. Click OK.

Step 4: Apply the File Screen to a Folder

Finally, you attach the template to your actual shared folder.

1. Click File Screens in the left pane.
2. Right-click and select Create File Screen.
3. Browse to the path of your shared folder (e.g., D:\Shares\Marketing).
4. Select “Derive properties from this file screen template” and choose your “Block Personal Media” template from the dropdown.
5. Click Create.

Step 5: Test the Configuration

Go to a client computer, navigate to the network share, and try to create a new text document. It will work perfectly. Now, rename that text document to test.mp3. The moment you press Enter, Windows will pop up an error stating: “You need permission to perform this action.” FSRM has successfully blocked the file extension, keeping your corporate storage clean and secure.