nexxai / CryptoBlocker

A script to deploy File Server Resource Manager and associated scripts to block infected users
GNU General Public License v2.0
200 stars 73 forks source link

not possible to enable active screening on C drive #8

Open bahshr opened 7 years ago

bahshr commented 7 years ago

Hi, I have a server with a share on the C drive.
The script generates everything but is not able to set active screening on the C drive. This is normal behaviour for windows. It is possible to put active screening on subfolders of the C drive. So maybe you could retrieve the shares with Get-SMBShare and put the active screening on the folders that are actually shared?

nexxai commented 7 years ago

Hey there! Thanks for the suggestion! If you want to update the script and submit a pull request that does this, I'd be more than happy to merge it into the main script!

PaulyHaley commented 7 years ago

That would be really useful for me too!

davidande commented 7 years ago

Hello, It's possible to active on shared folders on C drive. for 2008, 2012 and 2016 Get-WmiObject Win32Share | Select Name,Path,Type | Where-Object { $.Type -match '0|2147483648' } | Select -ExpandProperty Path | Select -Unique

It will not be active in administrative shares ex: c:, c:\windows...... but it will be on all other shares

PaulyHaley commented 7 years ago

Brilliant, that needs to replace line 77. Just tried this and it works.

nexxai commented 7 years ago

I've updated the script to use @davidande's logic

Peck49 commented 7 years ago

I approached the same problem this way as it produced less results. Puts a single active screen on any drive that is NOT C:\, but on the individual paths for any shares on C:\:

 Where-Object {$_ -like "C:\*"} | 
 ForEach-Object { 
                 ([System.IO.DirectoryInfo]$_).FullName  # Extract the path, as a string
                  } | Sort-Object -Unique 

Get-WmiObject Win32_Share | Where-Object { $_.Type -eq 0 } | Select-Object -ExpandProperty Path |
 Where-Object {$_ -notlike "C:\*"} | 
 ForEach-Object { 
                 ([System.IO.DirectoryInfo]$_).Root.Name  # Extract the Root, as a string
                  } | Sort-Object -Unique

Obviously I don't know how to paste code in as the backslashes and underscores are being dropped from my post. --- Never mind... Figured it out.