nexxai / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
200 stars 73 forks source link

Email notification settings overwritten. on each file screen. #19

Open TimLinnington opened 7 years ago

TimLinnington commented 7 years ago

Hello, I'm attempting to automate the update of the filescreens by calling the script which works great. Though, the admin email field on each individual file screen gets wiped out and I have to go into each file screen on each server to re-configure. It would be great if we could do something about this, either supply the email address or prevent it from getting rewritten. Perhaps this already exists but I can't find t he documentation. Thank you.

nexxai commented 7 years ago

While I don't have a great answer for you, what we've found is adding the email address to the FSRM options (right click the root "File Server Resource Manager (Local)" node and selecting "Configure Options...") with the "Default administrator recipients:" field.

Peck49 commented 7 years ago

I run two separate scripts. One for the install that I never run again, and I doctored and run a separate Maintenance script that uses the -modify switch when calling on filescrn.exe and updating the template with the new lists. In this way I can make changes to the template through the GUI that remain permanent, as the template is not deleted and re-added. I do this as I wanted to run some alternate commands on the command tab. Then the template is re-applied to the screens. Don't know if this approach would help in what you're looking to do...

TimLinnington commented 7 years ago

Nexxai, I do have the default administrator recipient set and I noted that option didn't get reset, though i didn't test it with the admin email blank on the file screen. if this works then all is well.

Peck, could you share your script? I think it would definitely fulfill my needs. We're really just trying to update the file screens weekly and the only easy way I know of doing this is through calling the original script again. Which seems to be OK if nexxai's idea works as I hope.

Thanks all.

Nicknack1234 commented 7 years ago

What about just changing line 19 of the script From "To=[Admin Email]" To "To=user@example.com"

On line 214 of the script you will see that the script actually deletes the template from FSRM and creates it fresh it each time you run it.

Gaz1986 commented 7 years ago

Here's how I've got around this:

&filescrn.exe $screenArgs &filescrn.exe template modify /template:"CryptoBlocker" "/Add-Notification:M,C:\Folder\mceml.inf" &filescrn.exe template modify /template:"CryptoBlocker" "/Add-Notification:C,C:\Folder\mccmd.inf" &filescrn.exe template modify /template:"CryptoBlocker" "/Add-Notification:E,C:\Folder\mcevnt.inf"

I've used .inf files but you can use any file format and customise your notifications accordingly

Look at the Notification Files for FSRM here: https://technet.microsoft.com/en-us/library/cc788122(v=ws.11).aspx