MBAR - Windows Server

[SLSHAMAL]

Hi,

is it possible to install MBAR to windows servers? if yes, which server will this support all the win servers or selected versions.

[gonzo]

No.  Client operating systems only (Windows 7, 8.x, 10).

[djacobson]

MBAR is a self extracting tool, Malwarebytes Anti-Rootkit scanner, it does not install. Do you mean MBARW, Malwarebytes Anti-Ransomware?

Edited April 26, 2017 by djacobson

[SLSHAMAL]

Yes, MBARW will it possible to install in windows server operating systems?

[gonzo]

Please read my response.  The answer is no.

[djacobson]

No, MBARW only supports workstation OS. Additionally, the MBARW protection software must be on the endpoints in order to protect a server share. If one of your users opens a macro infected office doc or malicious *.js or *.scr in a zipped email attachment, the malicious encryption process is not running on the server, therefor the server will not be able to stop the encryption process. It must be stopped at the source machines.

[SLSHAMAL]

What's the solution you have in Windows server protection from Ransomware?

[djacobson]

A server will not be at risk for ransomware unless one is using them for questionable purposes, like using them for internet browsing or opening email, which is a huge no no. You protect your servers by implementing solid policies around acceptable usage, a staggered backup schedule and having MBARW on the clients that connect to the servers.

Again, even if you put MBARW on a server, it cannot stop an encryption process that is running from an endpoint workstation. That ransomware process is located in the memory of the endpoint it unpacked on, you must have the MBARW software on the endpoint to be able to stop the encryption process before it reaches a server share / mapped drive.

[SLSHAMAL]

Thank you djacobson, i got the point.

[djacobson]

Hey @SLSHAMAL I was making that point more for people who will come across this thread in the future wondering the same thing, I wasn't trying to put you on blast. I just want your environment to be safe, a goal I know you share.

[vane]

On 4/26/2017 at 10:36 AM, djacobson said:

A server will not be at risk for ransomware unless one is using them for questionable purposes, like using them for internet browsing or opening email, which is a huge no no. You protect your servers by implementing solid policies around acceptable usage, a staggered backup schedule and having MBARW on the clients that connect to the servers.

Again, even if you put MBARW on a server, it cannot stop an encryption process that is running from an endpoint workstation. That ransomware process is located in the memory of the endpoint it unpacked on, you must have the MBARW software on the endpoint to be able to stop the encryption process before it reaches a server share / mapped drive.

What if Ransomware gets executed from the workstation and just encrypts the UNC Shares/ Mapped Drives ONLY - ignoring the files on the computer?

How can the server protects it self from computers that is infected by Ransomware?

Edited May 3, 2017 by vane

[djacobson]

MBARW will still kick off on the workstation as the encryption process is running on the workstation. What that process is encrypting does not matter, the important part is from where that process is running.