<div>
Actual crypto viruses don't need mapped drives. The can work already on accesible UNC shares when write/delete permissions exist.<br />
<br />
The only effective measure against such threats is simply a good backup strategy. This involves especially that the backup media is not accessible after the backups are taken.
</div>


<div>
Actually restricting use of file share is just a means to the end. I rather you take a more deeper understanding why in the first place Ransomware can get into your system. For the record, the malware gets into the machine due to unpatched vulnerability on the machine or due to poor user awareness whom click on phishing link or open up attachment file. Visiting non reputable side and plugging in unauthorized or personal thumb drive expose the machine further. User running as administrator by default worsen the situation. These are systemic issues that you should focus on more. <br />
<br />
File share using vulnerable protocol such as SMBV1 should be disabled. You should be using SMBV3 where possible. Otherwise SMBV2. <br />
<br />
Segregate out your network such that critical server does not easily get directly connected to all client, do segment and VLAN to management, user, backup, wired vs wireless, guest, Internet, etc. <br />
<br />
Adopt a higher demand on hygiene and discipline on the machine. Patch them early. Get AV signatures push down. User should be just user and not having administrator access. Use only authorised thumbdrive. Scan before use. <br />
<br />
Besides the file shares, ask that users do housekeeping and unmap drive even though you mentionwd on batch. Ransomware would not really care if it mapped drive, if they are targeted ones that check for SMB existence.<br />
<br />
Consider anti ransomware software e.g. from MalwareBytes . Or else minimally application whitelisting using like Applocker. Or cryptoprevent. Windows has controlled Folder access in latest version. <br />
<br />
Importantly, keep to a regime of backup and this is very critical as the last means if Ransomware get through the checks. Remember to keep the backup offline and not in network shares reachable by user machine otherwise ransomware may also encrypt it too. Adopt 3-2-1-1 principle. <br />
-Have at least three copies of your data.<br />
-Store the copies on two different media.<br />
-Keep one backup copy offsite.<br />
-Check at least one copy is recoverable.<br />
<br />
Better to adopt a more comprehensive approach as this threat is evolving beyond just file shares. You find check out below for other details too. <br />
<br />
<a href="https://www.experts-exchange.com/articles/28059/TL-DR-Ransomware-Infected.html" rel="ugc">https://www.experts-exchange.com/articles/28059/TL-DR-Ransomware-Infected.html</a>
</div>


<div>
Expert ste5an: I am aware crypto no longer requires mapped drives, and can access open shares, hence the batch files I suggested, with credentials to the share. The solution I need, is for Windows to not &quot;remember&quot; those credentials, when the share is closed. &nbsp;The batch file &nbsp;works correctly, if the computer is rebooted, after every time the share is closed, but that is obviously not a good solution. I was hoping for a way to force Windows to &quot;forget&quot; the credentials used in the batch file, when the share is closed.<br />
<br />
Expert btan: I appreciate the time you took, and it is all good advice, however, in public education scenarios, and non-profits, much of what you propose is impossible to implement, due to the volume of users, and the amount of time and money available to address the issue. I agree with all you have suggested, but at the moment, am looking for a faster, less time and money requirement strategy, to minimise risk somewhat. What I have proposed will work, if Windows can be set in the registry, or elsewhere, to disconnect a share, in a timely manner, or to not save credentials, in the same user session.<br />
<br />
Thanks to the both of you, and am still hoping someone can provide more knowledge.
</div>


<div>
In this case: When it would be possible, then you have created another security issue. You stored credentials in on the client.<br />
<br />
But when you delete all network drives with this credential you should be able to remove the cached credentials using klist /purge. And as long as those credentials are not in the key ring (cmdkey /list), you should have what you want (with the above caveat).
</div>


<div>
Excellent! Now we are making some progress!! I am aware that I have created a security issue, in that the credentials are now stored in the client pc, however, at least there will not be access to the share, unless it is already open, or the malware is smart enough to check every batch file on the pc, and harvest and use those, which in this case, the risk is acceptable to me. I was not familiar with the klist command, or the cmdkey command. So, would it be possible for my batch file to be something like this?<br />
<br />
start \\servername\share user:name password<br />
pause<br />
klist /purge<br />
<br />
Trying for the first line to open an explorer window to the directory, then the batch file pausing, then when user closes the explorer window, the batch file completing, and deleting just used credentials.<br />
I greatly appreciate your help in this.
</div>


<div>
Your batch should only work, when \\servername\share is the only share using this credentials. I guess it's time to test this.
</div>


<div>
I will report back...thanks
</div>


<div>
Excellent! This is what I was looking for, and it works. Thanks.<br />
Get rid of the credentials is to open an elevated command prompt and type in:<br />
net use \\server\share /delete<br />
then type in:<br />
klist purge
</div>


<div>
<div class="content wysiwyg-content">
Work at a 35 user business, where many files are shared. Some files are on a NAS box, and some just shared on one of the servers (2003, and 2012) We have used mapped drives for years, but with the arrival of crypto malware, trying to minimize potential damage, when a user gets infected. My thought was to set up batch file to open share, with no drive letter mapping, such as <br />
start \\servername\share user:name password. The result is the share folder opens, and they have accesss to what they want, and when browse window is closed, connection ends. Except, it really doesn't, because after first time opening and closing, we can now just browse to the share, and open without credentials, as session evidently doesn't actually terminate. <br />
I also work for three small schools, with the same situation, I am trying to resolve. &nbsp;Any suggestions will be greatly appreciated.
</div>
</div>


Work at a 35 user business, where many files are shared. Some files are on a NAS box, and some just shared on one of the servers (2003, and 2012) We have used mapped drives for years, but with the arrival of crypto malware, trying to minimize potential damage, when a user gets infected. My thought was to set up batch file to open share, with no drive letter mapping, such as 
start \\servername\share user:name password. The result is the share folder opens, and they have accesss to what they want, and when browse window is closed, connection ends. Except, it really doesn't, because after first time opening and closing, we can now just browse to the share, and open without credentials, as session evidently doesn't actually terminate. 
I also work for three small schools, with the same situation, I am trying to resolve.  Any suggestions will be greatly appreciated.

Network share, security

Networking is the process of connecting computing devices, peripherals and terminals together through a system that uses wiring, cabling or radio waves that enable their users to communicate, share information and interact over distances. Often associated are issues regarding operating systems, hardware and equipment, cloud and virtual networking, protocols, architecture, storage and management.