domains / families / security / implementing-anti-ransomware-group-policy

implementing-anti-ransomware-group-policy

separate

'Configures Windows Group Policy Objects to block ransomware execution

When to use

• Hardening a Windows Active Directory environment against ransomware execution and propagation
• Implementing defense-in-depth by blocking ransomware execution paths via Group Policy
• Configuring AppLocker or WDAC rules to prevent unauthorized executables from running in user-writable directories
• Enabling Controlled Folder Access to protect critical directories from unauthorized file modifications
• Restricting lateral movement vectors (RDP, SMB, WMI) that ransomware uses to spread across the domain

When not to use

• Standalone ransomware defense
• Replacing endpoint detection
• Replacing backups
• Replacing network segmentation
• Replacing user awareness training

Skill page

Source