【发布时间】:2016-12-07 03:20:26
【问题描述】:
我想分享这个脚本来阻止勒索软件,然后分享给大家。 我唯一的一点是添加多个驱动器并在创建文件时捕获错误或成功。
这是做什么的
- 安装 FSRM 工作。
- 创建文件屏幕出现问题,驱动器无法选择超过 1 个。
- 它应该捕获文件是否已创建,因此我们可以说它失败了。
- 捕获访问被拒绝并说它正在工作。
希望有人能帮忙
#Check If FSRM is Are Already Installed
$check = Get-WindowsFeature | Where-Object {$_.Name -eq "FS-Resource-Manager"}
if ($check.Installed -ne "True") {
Install-WindowsFeature -Name FS-Resource-Manager -IncludeManagementTools
} else {
Write-Host "Cool FSRM is already installed" -F Green
}
#define drive letters here
$drive = @("D:\", "E:\", "C:\users")
#Create notification is required
#$Notification = New-FsrmAction -Type Email -MailTo "[Admin Email];[File Owner]" -Subject "Warning: attempted to create a Ransomeware file text file" -Body "You attempted to create a Ransomeware. This is not allowed." -RunLimitInterval 120
New-FsrmFileGroup -Name "Anti-Ransomware File Groups" -IncludePattern @((Invoke-WebRequest -Uri "https://fsrm.experiant.ca/api/v1/combined" -UseBasicParsing).Content |
ConvertFrom-Json | % {$_.filters})
New-FsrmFileScreen -Path "$drive" -IncludeGroup "Anti-Ransomware File Groups" -Active # -Notification $Notification
#test if its working
try {
New-Item "$drive\$(get-random).xtbl" -Type File -ErrorAction Stop
Write-Verbose "[RANSOMEWARE CONFIGURATION FAILED] Created $FullName"
} catch {
$ErrorMessage = $_.Exception.Message
Write-Warning "[ERROR] access Denied"
Write-Host "Congrats you have successfully configured Ransomeware block Sit back and relax"
}
【问题讨论】:
-
Shay Levi 在本主题中的回答对您有用吗? stackoverflow.com/questions/8693675/…
-
不要这么想所以我们不需要使用 wmi
-
更多地指的是$?作为关于您先前命令成功的自动变量,您没有检查 Shay Levi 的答案。
标签: powershell