0

I am trying to build a simple variant of the "ransomware canary," where FSRM watches a directory, and if there are any changes at all, it immediately shuts down the computer.

Here is my PowerShell code:

# Ransomware Canary
# Kenton
# December 28, 2018
#
# Creates an FSRM file screen that watches a folder(s) for any file changes, 
# immediately shuts down the server if any are detected to slow down ransomware attacks

$CanaryPath = "C:\Users\Administrator\Desktop\Acounting"  # Path to monitor, deliberately misspelled 
$AnyGroup = "Any"  # Name of FSRM file group to catch all files
$ShutdownCmd = "C:\Windows\System32\shutdown.exe"  # Location of shutdown command
$ShutdownParameters = "/s /f"  # /s = shut down computer immediately; /f = force close applications

# Install File Server Resource Manager (FSRM)
Add-WindowsFeature -Name FS-Resource-Manager -IncludeManagementTools

# Define file group to catch all possible names, since any changes in this folder should be disallowed
New-FsrmFileGroup -Name $AnyGroup -IncludePattern @("*")

# Define action to shut down computer
$ShutdownAction = New-FsrmAction -Type Command -Command $ShutdownCmd -CommandParameters $ShutdownParameters -SecurityLevel LocalSystem

# Define file screen
New-FsrmFileScreen -Path $CanaryPath -IncludeGroup $AnyGroup -Notification $ShutdownAction -Active

Most everything seems to work, but when I add the $ShutdownAction to the -Notification parameter of New-FsrmFileScreen, it generates the following error:

New-FsrmFileScreen : 0x8004530d, The specified property is out of range.
At C:\Users\Administrator\Desktop\add-ransomware-canary.ps1:23 char:1
+ New-FsrmFileScreen -Path $CanaryPath -IncludeGroup $AnyGroup -Notific ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (MSFT_FSRMFileScreen:Root/Microsoft/..._FSRMFileScreen) [New-FsrmFileScree
   n], CimException
    + FullyQualifiedErrorId : HRESULT 0x8004530d,New-FsrmFileScreen

I've based this pattern on another example here, but it uses the "Email" type instead of the "Command" type. I haven't found many examples with the "Command" type. I'd originally made this in the GUI, and it all seemed to work, just not in PowerShell. Is there something obviously wrong with my code?

0

I have found the answer here, hat tip to GradeA-Phil on TechNet. Bottom line is that you have to add a -KillTimeOut parameter to New-FsrmAction, because its default value of -1 is unacceptable to New-FsrmFileScreen.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.