skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-anti-ransomware-group-policy

Configures Windows Group Policy Objects to block ransomware execution and limit lateral movement.

954|172|Updated Mar 13, 2026
Search Tags:#ransomware#group policy#Active Directory#controlled folder access#asr rules#applocker#windows hardening
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-anti-ransomware-group-policy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-anti-ransomware-group-policy
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ransomware-defense/implementing-anti-ransomware-group-policy
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-anti-ransomware-group-policy

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Ransomware commonly executes from user-writable directories, abuses Office macros, deletes shadow copies, and spreads via SMB, RDP, and WMI. This Skill guides the configuration of Windows Group Policy Objects that block these execution and propagation paths across an Active Directory domain.

Core Features & Use Cases

  • AppLocker Rules: Deny executables in user-writable paths like %AppData%\Temp, Downloads, and Desktop while allowing signed Windows and Program Files binaries.
  • Controlled Folder Access & ASR Rules: Enable Microsoft Defender Exploit Guard protections, including blocking Office child processes, obfuscated scripts, and executable email content.
  • Lateral Movement Restrictions: Disable SMBv1, restrict RDP and WMI, turn off AutoPlay, and enforce signed PowerShell scripts.
  • Use Case: A domain administrator hardening a Windows Server 2016+ environment uses this Skill to build and verify a test-OU GPO that blocks shadow-copy deletion and macro-based payloads before domain-wide rollout.

Quick Start

Help me configure a Group Policy Object that blocks ransomware execution paths with AppLocker, enables Controlled Folder Access, and sets ASR rules to Block mode on my Windows domain.

Frequently Asked Questions about implementing-anti-ransomware-group-policy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I block ransomware with Windows Group Policy?▼

Create a GPO combining AppLocker deny rules for user-writable paths, Controlled Folder Access in Block mode, and ASR rules targeting Office macros and script abuse. Apply it to a test OU first, then verify with gpresult and simulated attack attempts.

How to configure AppLocker to stop ransomware execution?▼

Add deny rules for paths like %AppData%\Local\Temp, %AppData%\Roaming, Downloads, and Desktop, while allowing C:\Windows and Program Files. Ensure the Application Identity service is set to Automatic, or the rules will not enforce.

Does AppLocker work on Windows 10 Pro?▼

No, AppLocker requires Windows 10/11 Enterprise or Education editions. On Pro editions, consider WDAC policies or third-party application control tools as alternatives.

Why are my ASR rules not blocking ransomware behavior?▼

ASR rules set to action value 2 run in Audit mode and only log events without blocking. Verify AttackSurfaceReductionRules_Actions is set to 1 (Block) using Get-MpPreference on the endpoint.

Does Controlled Folder Access protect network file shares?▼

Not by default; CFA only auto-protects local folders like Documents and Desktop. UNC paths such as \\fileserver\finance must be added explicitly under Configure protected folders in the GPO.

When should I not rely on GPO settings alone for ransomware defense?▼

GPO hardening is not a standalone defense. It must be combined with endpoint detection, tested backups, network segmentation, and user awareness training to provide adequate ransomware protection.

Related Skills

Explore More Software Engineering Skills→
yaklangyaklang
1.6k

active-directory-acl-abuse

Map Active Directory ACL configurations and BloodHound paths to plan privilege escalation.

Official
Advanced
expanso-ioexpanso-io

expanso-deduplicate-events

Deduplicate HTTP events via content hashing and cache, outputting unique events to Kafka.

Official
Intermediate
Renzo-TognellaRenzo-Tognella

validating-backup-integrity-for-recovery

Validate backup integrity with cryptographic hash verification and restore testing.

Community
Advanced
sjinkssjinks

security-review-owasp-third-party-javascript-management

Review third-party JavaScript management risks in web applications.

Community
Advanced