Implementing Anti-Ransomware Group Policy

When to Use

• Hardening a Windows Active Directory environment against ransomware execution and propagation
• Implementing defense-in-depth by blocking ransomware execution paths via Group Policy
• Configuring AppLocker or WDAC rules to prevent unauthorized executables from running in user-writable directories
• Enabling Controlled Folder Access to protect critical directories from unauthorized file modifications
• Restricting lateral movement vectors (RDP, SMB, WMI) that ransomware uses to spread across the domain

Do not use as a standalone ransomware defense. GPO settings complement but do not replace endpoint detection, backups, network segmentation, and user awareness training.

Prerequisites

• Windows Server 2016+ Active Directory environment with Group Policy Management Console (GPMC)
• Domain Admin or Group Policy Creator Owners privileges
• Windows 10/11 Enterprise or Education (required for AppLocker and WDAC)
• Microsoft Defender Antivirus enabled (required for Controlled Folder Access and ASR rules)
• Python 3.8+ for audit script that validates GPO compliance
• Test OU for validating GPO settings before domain-wide deployment

Workflow

Step 1: Block Ransomware Execution Paths with AppLocker

Configure AppLocker to prevent executables from running in common ransomware staging locations:

AppLocker GPO Path:
  Computer Configuration → Policies → Windows Settings →
  Security Settings → Application Control Policies → AppLocker

Key Rules:
━━━━━━━━━
1. DENY executable rules for user-writable paths:
   - %USERPROFILE%\AppData\Local\Temp\*     (email attachment extraction)
   - %USERPROFILE%\AppData\Roaming\*         (CryptoLocker staging)
   - %USERPROFILE%\Downloads\*               (web downloads)
   - %TEMP%\*                                (temporary extraction)
   - %USERPROFILE%\Desktop\*                 (social engineering drops)

2. ALLOW default rules:
   - C:\Windows\* (signed by Microsoft)
   - C:\Program Files\* and C:\Program Files (x86)\*
   - Administrator group: all paths

3. Enable Application Identity service:
   Computer Configuration → Policies → Windows Settings →
   Security Settings → System Services →
   Application Identity → Automatic