search

nexxai / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
200 stars 73 forks source link

modifying the File Screen Command #49

Open Lanesystems opened 6 years ago

Lanesystems commented 6 years ago

Hi, just wondering if anybody has managed to modify commands with this script for File Screens. We like to put in the following powershell command to block the user account access to the shares to try and prevent that account from causing more harm on the network:

_Run this command or script: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

-ExecutionPolicy Unrestricted -NoLogo -Command "& { Get-SmbShare -Special $false | ForEach-Object { Block-SmbShareAccess -Name $.Name -AccountName '[Source Io Owner]' -Force } }"

of course asking a powershell script to enter another script in plain text is a little janky so if there are any better suggestions i am all ears.
I love how quickly it sets everything up though =)

Lanesystems commented 6 years ago

before anyone asks, we do have a script that reverses the above block, so that we can manually enable the accounts again when we believe they are safe.