Video: SOLVED: How to Use File Server Resource Manager in Windows Server To Block Crypto Malware

This video deblock-cryptolockermonstrates how to configure Windows Server File Server Resource Manager to block Crypto malware like Cryptolocker / Cryptowall and other ransomware. FSRM is built into Windows Server and is free… you just need to turn it on!

  1. Install FSRM
    Server Manager > Manage > Add Roles and Features > Add Roles and Features Wizard > Server Roles> File and Storage Services > File and iSCSI Services > File Server Resource Manager
  2. Open File Server Resource Manager
  3. File Screening Management > File Groups > Create File Group
    File group name: Ransomware files
    Files to include:  *.crypto
  4. File Screening Management > File Screen Templates > Create File Screen Template
    Settings tab
    Template name: Ransomware Files
    Screening type: Passive screening
    File groups: Select ‘Ransomware files’
    E-mail Message tab: Enter text as desired
    Event Log tab: Check “Send warning to event log”

5.  File Screening Management > File Screens > Create File Screen
File screen path: Select the path you want this to apply to
Select: “Derive properties from this file screen template (recommended)”
Select: ‘Ransomware Files’

 

Click HERE for the SCRIPT file that includes many of the 2016 malware file names you likely want to block.

 

Questions or Comments?