Read file but prevent download windows server

Legal notice: You may not, under any circumstances, resell or reproduce any information for commercial use without the express prior written consent of File-Extensions. Scripts to automatically harvest results are strictly prohibited due to performance reasons and will result in your IP being banned from this website. Enter any file extension without dot e. How to restrict certain file types in Windows Group Policy Administrate rights for files based on their extension in Windows Server.

Sign up using Facebook. Sign up using Email and Password. Post as a guest Name. Email Required, but never shown. The Overflow Blog. Podcast what if you could invest in your favorite developer? Who owns this outage? Building intelligent escalation chains for modern SRE.

While the Execute permission on PE-format files. SYS, etc. JS, possibly even. Improve this answer. HTA , — MichaelEvanchik. MichaelEvanchik are you claiming those file types do, or do not, respect the Execute permission? EDIT We both missed one:. SCR is an executable PE binary, basically identical to a.

EXE except specifically for use with screen savers. CBHacking, I have poked around using your information. I now see what you mean, and am a little terrified of locking myself out entirely. Or am I making this needlessly complex? It should be moved out first. Connect and share knowledge within a single location that is structured and easy to search.

Is this possible? You can specify who has the rights to read and write files. But if you give users the right to read files, the can read the files. That is the point of allowing them read access. You can set the rights so nobody can read the files, but then why place them in a network share? This is a problem that's generally solved with an administrative policy rather than via technical means. For example, you could force users to sign something saying that if they download the files off the network share onto any other device it's a termination-level offense before granting them permissions to access the share.

You might also want to turn on auditing on the share to see who's accessing which files, but I don't believe it'll alert you if they copy the files elsewhere.

Auditing would tell you that they accessed the file if they read or copy it. The protection works! In the log located in the root of the disk you can see the directory and the user account the ransomware has been attempted to be run from. So, we have considered how to automatically block network share access to the users whose computers are infected by ransomware.

Naturally, using FSRM in this way cannot fully protect files on your servers from this kind of malware, but it is suitable as one of the protection levels. Notify me of followup comments via e-mail. You can also subscribe without commenting. Leave this field empty.