Modern ransomware does not start by encrypting your files. It starts by finding and destroying your backups — because backups are the reason victims refuse to pay.
The repository is the most valuable folder in your office: every PC's entire contents, in one place, writable over the network. That makes it target number one in any serious attack — and also the thing that decides whether an attack is a bad week or the end of the business. Site Manager deployments have real defences available, including one built by Macrium for exactly this. This guide layers them honestly, in the order to apply them.
Macrium Image Guardian (MIG) is Macrium's own shield for backup files: it watches the repository storage and prevents other processes from modifying or deleting protected Macrium image files — including ransomware trying to encrypt them and a malicious or mistaken deletion. It is offered as part of the Site Manager installation options, and on the machine hosting your repository it is the single highest-value checkbox in this entire guide. Install it where the images live, confirm it reports active, and treat any MIG warning in the console as a drop-everything event.
Every defence above assumes the attacker is outside your admin accounts. A determined attacker who steals a domain admin password can defeat share permissions and even protection software. The layer that survives that is separation: a copy of the repository that is offline (rotated external drives, unplugged between syncs), off-site, or in cloud storage with its own credentials and versioning. Sync the repository on a schedule, keep at least one generation back, and test restoring from the separated copy during your quarterly restore test — an untested copy is a rumour.
Attackers go for the backup server because it holds the keys to every machine. Harden it like it matters: keep Windows and the Site Manager platform patched, limit who can log on to it, do not browse the web or read mail on it, and back up the server's own configuration as part of your repository sync so the console itself can be rebuilt. The goal is boring and specific — when everything else in the office is encrypted, this one machine and its storage should still be standing, holding clean images.
Server install, agent push, backup definitions and schedules — the whole Macrium Site Manager deployment, live and step by step.
▶️ Watch Full VideoNo. Image Guardian stops other processes from modifying or deleting image files on that storage, which defeats the common ransomware pattern. It cannot help if the whole server is destroyed, stolen, or fully taken over by an attacker with deep control. Guardian protects the files; separation protects the building. You need both layers.
Image encryption protects the data if repository storage or an off-site drive is lost or stolen — worth it for the off-site copies especially. Just guard the password like a licence key: an encrypted image whose password is lost is indistinguishable from no backup, so store it in the office password vault, not in one person's memory.
Yes, with NAS-flavoured steps: use a dedicated share and a NAS-local backup account that exists for nothing else, disable or restrict other access paths to that share, enable the NAS's own snapshot feature on the repository share if it offers one, and keep the NAS firmware updated. The principles — least access, one unreachable copy, tested restores — are identical on any storage.