How to Block Ransomware using Policy Group Exceptions

Unfortunately, there’s no product that’s 100 percent effective blocking ransomware.

But there are precautions you can take to lower the risk of an attack.

Here at Acumen, our president, Rob Wagnon, says the best methods for prevention are to:

In addition to these recommendations, you should also block executables from your AppData folder by creating a Group Policy.

 In the next section, we’ll show you how to lock down your servers and workstations using Group Policy settings to minimize the risk of future attacks.

1. First, open up Group Policy and scroll down to Domain –> Computers –> SBSComputers
2. Next, right click on SBSComputers and select ‘Create a GPO in this domain and link…’
3. After that, title this policy Prevent CryptoLocker Vista and higher and click OK
4. Then, right click on this policy and select Edit
5. Navigate to Computer Configuration –> Policies –> Windows Settings –> Security Settings –> Software Restriction Policies
6. Right click on Software Restriction Policies and click on ‘New Software Restriction Policies’
7. Right click on Additional Rules and click on ‘New Path rule’ and then enter the following information and then click OK
   1. Path = %localAppData%*.exe
   2. Security Level = Disallowed
   3. Description: Don’t allow executables from AppData
8. Repeat Step 7 for AppData subfolders
   1. Path = %localAppData%**.exe
   2. Security Level = Disallowed
   3. Description: Don’t allow executables from AppData subfolders
9. Close this policy configuration window
10. Finally, from the Prevent CryptoLocker Vista and higher policy locate WMI filtering near the bottom of the middle frame and select ‘Windows SBS Client – Windows Vista’

1. First, open up Group Policy and scroll down to Domain –> Computers –> SBSComputers
2. Next, right click on SBSComputers and select ‘Create a GPO in this domain and link…’
3. Then, title this policy Prevent CryptoLocker XP and click OK
4. After that,  click on this policy and select Edit
5. Next, navigate to Computer Configuration –> Policies –> Windows Settings –> Security Settings –> Software Restriction Policies
6. Then, right click on Software Restriction Policies and click on ‘New Software Restriction Policies’
7. Right click on Additional Rules and click on ‘New Path rule’ and then enter the following information and then click OK
   1. Path = %AppData%*.exe
   2. Security Level = Disallowed
   3. Description: Don’t allow executables from AppData
8. Repeat Step 7 for AppData subfolders
   1. Path = %AppData%**.exe
   2. Security Level = Disallowed
   3. Description: Don’t allow executables from AppData subfolders
9. Close this policy configuration window
10. Finally, from the Prevent CryptoLocker XP policy locate WMI filtering near the bottom of the middle frame and select ‘Windows SBS Client – Windows XP’

Occasionally, you might come across a program that puts .exe files in the AppData folder. In order to install the program, you’ll need to create an exception to your group policy.

1. First, from the server, open up Group Policy Management console
2. Next, scroll down local –> MyBusiness –> Computers –> SBSComputers

Modify the XP rule

3. Then, right click on the Prevent CryptoLocker XPrule, and click Edit
4. Scroll down Computer Configuration –> Policies –> Windows Settings –> Security Settings –> Software Restriction Policies
5. Next, right click on Additional Rules, then click New Path rule… and create a new rule for the exception.
6. The path rule should be written in this format:

%AppData%_________.exe

Next…

7. In the blanks, insert the name of the program you’re installing.
8. Then, in the description, type Allow ______ to run. In the blank, insert the name of the program you’re installing.
9. After that, click OK

Modify the Vista and higher rule

10. Right click on the Prevent CryptoLocker Vista and higherrule, and click Edit
11. Drill down Computer Configuration –> Policies –> Windows Settings –> Security Settings –> Software Restriction Policies
12. Finally, right click on Additional Rules, then click New Path rule… and create a new rule for the exception.

You’ll need to wait about 90 minutes for Group Policy changes to be broadcasted to all workstations. But if you’re in a hurry, you can speed up the process by going through the server:

1. First, from the server, open up an elevated command prompt and run: gpupdate /force
2. Then from your workstation, open up an elevated command prompt and run: gpupdate /force

To find out how Acumen can help protect your Business from ransomware, contact us today. 

CryptoLocker can access your files in more ways than one. Click here to learn more about how this malicious virus can access your private business files.