{"id":2902,"date":"2016-03-30T05:40:09","date_gmt":"2016-03-30T09:40:09","guid":{"rendered":"https:\/\/antipaucity.com\/?p=2902"},"modified":"2016-03-30T05:40:09","modified_gmt":"2016-03-30T09:40:09","slug":"can-you-disable-encryption-on-a-windows-server","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=2902","title":{"rendered":"can you disable encryption on a windows server?"},"content":{"rendered":"<p>This was <a href=\"http:\/\/serverfault.com\/q\/762439\/2321\">asked<\/a> recently on Server Fault.<\/p>\n<blockquote><p>I&#8217;m asking if there&#8217;s a way to prevent files from being encrypted. I&#8217;m referring to some extent to ransomware, but specifically I want the following scenario:<\/p>\n<ul>\n<li>Windows File server w\/ shares (on the E: drive)<\/li>\n<\/ul>\n<p>I want a way to tell the above server &#8220;don&#8217;t allow files on the E: drive to ever be encrypted by anyone or any software\/process.&#8221;<\/p><\/blockquote>\n<p>And, of course, the answer to this question is &#8220;no&#8221;, as <a href=\"http:\/\/serverfault.com\/a\/763709\/2321\">I<\/a> and others said:<\/p>\n<blockquote><p>No, you cannot prevent files from being encrypted. How is the OS supposed to know if a file is encrypted vs being of some format it doesn&#8217;t &#8220;know&#8221; about?<\/p>\n<p>You can disable OS-level encryption, and perhaps some programs from running via GPO, but that cannot stop every program, nor users uploading already encrypted files.<\/p>\n<p>What you want to do is ensure users are only putting files where they are supposed to &#8211; and no where else.<\/p><\/blockquote>\n<p>But more interesting is <em>why<\/em> you would even ask something like this: is it because you really only want &#8220;plaintext&#8221; files on the share? (Even when the &#8220;plaintext&#8221; is a binary format (like an EXE, PNG, etc?) I suppose there could be &#8220;value&#8221; is disallowing even the <em>concept<\/em> of encrypted files .. but since encrypted files <em>look like files<\/em> (albeit ones that are not readably openable).<\/p>\n<p>And I think this really belies an exceptionally-poor understanding of what {{encryption}} is &#8211; and what it is not. Encryption is meant to protect (or hide) specific content (the &#8220;specific content&#8221; might be the entirety of your phone or hard drive, or an email, or a trade secret, etc) from eyes who shouldn&#8217;t be allowed to see what is happening. Yes, there is {{ransomware}} that will encrypt or obfuscate files or {{file systems}} and demand payment to be decrypted &#8211; but attempting to solve for that corner case by attempting to disallow even the <em>concept<\/em> of encrypted data is highly misguided: the way to prevent\/mitigate ransomware is by a combination of good system management practices, solid {{IDS}} and IDP software\/appliances, sane {{anti-virus}} policies, and general good user behavior. (And, maybe, by using OSes less targeted by ransomware authors.)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This was asked recently on Server Fault. I&#8217;m asking if there&#8217;s a way to prevent files from being encrypted. I&#8217;m referring to some extent to ransomware, but specifically I want the following scenario: Windows File server w\/ shares (on the E: drive) I want a way to tell the above server &#8220;don&#8217;t allow files on &hellip;<br \/><a href=\"https:\/\/merikebi.warrenmyers.com\/?p=2902\" class=\"more-link pen_button pen_element_default pen_icon_arrow_double\">Continue reading <span class=\"screen-reader-text\">can you disable encryption on a windows server?<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[7,41],"tags":[280,616,668,852],"keyring_services":[],"class_list":["post-2902","post","type-post","status-publish","format-standard","hentry","category-commentary","category-technical","tag-encryption","tag-ransomware","tag-security","tag-windows"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/2902","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2902"}],"version-history":[{"count":0,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/2902\/revisions"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2902"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=2902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}