Help me setup File screening / FSRM

[TwistedHelixis]

Hello all. I have found a good few sites that go over step by step setting up file screening on a 2012r2 system, but none seem to answer some basic questions I have.

 

At my primary school I have 1 host with 2 vm servers, 1 DC and 1 Data.

 

Should I install FSRM on to the data server only? or should it get installed on to my DC? Does it only monitor local files or does it deploy across the network.

 

I am sure if I had time to installed and play with it, all the basic questions would be void, but I have not and someone else will already know these things.

 

Any good install step by steps or gotchas would be a great help also.

[TechMonkey]

FSRM is put on any file server you want to monitor. It will then monitor a path that you define against a template you create. The template consists of a file group (list of file types or file names) and what to do.

 

The big question is what are you attempting to do with it?

[zag]

Yep only install on the file server. Standard basic setup would be to disallow executables on a file share or user area.

 

Very easy to setup, should only take 20mins.

[TwistedHelixis]

The big question is what are you attempting to do with it?

 

It was something that was mentioned on Edugeek during the wannacry attacks. I have disabled SMBv1, installed ransom protection on the server etc and this was next on my list.

[TwistedHelixis]

Does anyone have a list of recommended executables to block?

[TechMonkey]

Does anyone have a list of recommended executables to block?

 

If you can hold off for a few minutes I will find the PowerShell scripts that I used. This installs FSRM on any host you point it at and sets up the latest list.

[TechMonkey]

Here it be https://github.com/BeauregardJones/Crypto-Detect or Google Drive https://drive.google.com/drive/folders/0B4TSMVURDdCpTzA0ek9Gcm9WWDA

[zag]

FSRM also has a template for program files.

 

Regarding ransomware, it doesnt really block it as the extensions change all the time. But its worth installing anyway.

[ozydave]

As TechMonkey. The GitHub scripts is ace

[TwistedHelixis]

Think I will install manually on a test server, just so I understand the basics and then take a look at the script.

 

Is it OK to run the script on a server running Sims, SQL etc.

 

If I already have a file in a share and then install file screening and that file is on the disallow list, will it leave that file as is and only screen new files or will it block that file?

[ozydave]

Yep I ran it on all my servers. Sims included. Not brace enough on DC's though.

I had FSRM already running on my shared area server and home drive server and just run the script and it just added the file screens

[caffrey]

I use this one https://github.com/m-dwyer/CryptoBlocker

[TwistedHelixis]

Yep I ran it on all my servers. Sims included

So does it not stop executable files from running in the Sims share? I assumed it should.

[TechMonkey]

Think I will install manually on a test server, just so I understand the basics and then take a look at the script.

 

Is it OK to run the script on a server running Sims, SQL etc.

 

If I already have a file in a share and then install file screening and that file is on the disallow list, will it leave that file as is and only screen new files or will it block that file?

 

Depends on what you set. You can have it in passive mode and set it to send you an email for any issues. I'd probably recommend that if you are installing it on a server with files all ready there.