Erpresser Prävention

param([string]$sharepath,[string]$username)
Get-SmbShare | ?{$_.Path -eq $sharepath} | Block-SmbShareAccess -AccountName $username -Force

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

-ExecutionPolicy ByPass -File "C:\share_access_blocker.ps1" "[File Screen Path]" "[Source Io Owner]"

-ExecutionPolicy ByPass -command "Get-SmbShare | ?{$_.Path -eq '[File Screen Path]'} | Block-SmbShareAccess -AccountName '[Source Io Owner]' -Force"

param([string]$sharepath,[string]$username)
# Share-Object holen
$share = gwmi "win32_share" | ?{$_.Path -eq $sharepath}  
# Security-Descriptor des Shares ermitteln
$sd = (Get-WMIObject Win32_LogicalShareSecuritySetting | ?{$_.Name -eq $share.Name}).GetSecurityDescriptor().Descriptor
# Trustee User für die neue ACE erstellen
$trustee = ([wmiclass]'Win32_trustee').psbase.CreateInstance()  
# Domain und Username des Trustee's setzen 
$trustee.Domain = $username.split('\')  
$trustee.Name = $username.split('\')[1]  
# FullAccess Deny ACE erstellen
$ace = ([wmiclass]'Win32_ACE').psbase.CreateInstance()  
$ace.AccessMask = 2032127; $ace.AceFlags = 0; $ace.AceType = 1;$ace.Trustee = $trustee
# ACE dem SD hinzufügen
$sd.DACL += $ace
# Share mit neuem SD versehen
$share.SetShareInfo(0,$share.Description,$sd)

gwmi win32_share | ?{$_.Path -eq 'C:\Pfad\xyz'} | select Name  

$logfile = "c:\Scripts\logfile.csv"  
$events = Get-EventLog -LogName application -Source SRMSVC -After (get-date).AddMinutes(-10) | select ReplacementStrings -Unique
if ($events.count -gt 50)
    {
	#Test nicht runterfahren...
        #stop-computer -force
    }
else
    {
        foreach ($event in $events)
            {
                $sourceuser = $event.ReplacementStrings
                $smbsharepath = $event.ReplacementStrings[1]
                
                $pos = $smbsharepath.LastIndexOf("\")  
                $rightPart = $smbsharepath.Substring($pos+1)
		
		# Name der Freigabe über Lokalen Pfad...
		$freigabeName = gwmi win32_share | ?{$_.Path -eq $smbsharepath} | select Name
	
		
		$strFreigabe = "$freigabeName"  
		$strFreigabe = $strFreigabe.replace("@{Name=","").replace("}","")  

                
                $smbcacl1 = "C:\Scripts\subinacl /verbose=1 /share \\127.0.0.1\" + "$strFreigabe" + " /deny=" + "$sourceuser"  
                
		# not in use 
		#$smbcacl2 = "C:\Scripts\subinacl /verbose=1 /share \\127.0.0.1\" + "$strFreigabe" + "$" + " /deny=" + "$sourceuser" 
	                            
                cmd /c $smbcacl1
                
              
                $log = "$sourceuser" + ";" + "$smbsharepath" + ";" + "$strFreigabe" + ";" + $smbcacl1   
                $log | add-content $logfile
            }
    }