implementing-anti-ransomware-group-policy

# Implementing Anti-Ransomware Group Policy ## When to Use - Hardening a Windows Active Directory environment against ransomware execution and propagation - Implementing defense-in-depth by blocking ransomware execution paths via Group Policy - Configuring AppLocker or WDAC rules to prevent unauthorized executables from running in user-writable directories - Enabling Controlled Folder Access to protect critical directories from unauthorized file modifications - Restricting lateral movement vectors (RDP, SMB, WMI) that ransomware uses to spread across the domain **Do not use** as a standalone ransomware defense. GPO settings complement but do not replace endpoint detection, backups, network segmentation, and user awareness training. ## Prerequisites - Windows Server 2016+ Active Directory environment with Group Policy Management Console (GPMC) - Domain Admin or Group Policy Creator Owners privileges - Windows 10/11 Enterprise or Education (required for AppLocker and WDAC) - Microsoft Defender Antivirus enabled (required for Controlled Folder Access and ASR rules) - Python 3.8+ for audit script that validates GPO compliance - Test OU for validating GPO settings before domain-wide deployment ## Workflow ### Step 1: Block Ransomware Execution Paths with AppLocker Configure AppLocker to prevent executables from running in common ransomware staging locations: ``` AppLocker GPO Path: Computer Configuration → Policies → Windows Settings → Security Settings → Application ...