When ransomware hits one office PC, it does not stop at that PC. It uses the victim's own logins to walk through every shared folder it can write to — and encrypts the lot. Your permission list decides how far it gets. This page sets that list like a blast wall.
Think of it mechanically: malware runs as the user it infected. It can open, change and delete exactly what that user can — nothing more, nothing less. So every right you hand out “just in case” is a right you are also handing to anything that ever infects that person's PC. Permission hygiene is not tidiness; it is damage control decided in advance.
Search your shared folders for the worst entry in Windows sharing: Everyone — Full Control, on either list. It grants every account — and with password protection off, effectively every device — total power including changing permissions. Replace it with named groups at the level they actually need. While you are there, apply the same thinking to the broad Users group: if all staff accounts land in it, a Modify grant to Users is a Modify grant to everyone.
Every folder moved from Modify to Read is a folder one infection cannot encrypt. On a typical office share, that is most of the data.
SMB1 is the 1980s-era version of the sharing protocol, kept only for ancient devices. The WannaCry outbreak that crippled hospitals and offices worldwide spread through SMB1. If no genuinely old device (some very old scanners and NAS boxes) needs it, disable it on the file PC from an admin PowerShell: Set-SmbServerConfiguration -EnableSMB1Protocol $false. Check first with Get-SmbServerConfiguration — and if something breaks, it was silently depending on SMB1 and deserves replacing, not re-exposing.
Permissions limit the blast; they do not undo it. The offices that shrug off ransomware have one thing: a copy of the data that the infected PC cannot write to. That means a backup drive that is unplugged after the backup, a NAS with its own separate login the office PCs do not save, or a cloud backup with version history. Be honest about two popular non-solutions: a permanently connected backup drive gets encrypted too, and shadow copies are routinely deleted by ransomware itself (vssadmin delete shadows is a standard step). A backup the malware can reach is a second copy of the problem.
The video builds the permission side of this defence step by step — groups, levels and the settings that matter.
▶️ Watch Full VideoNo — encryption means writing modified files back, and Read does not allow writing. The malware could still read and steal the data, which is its own serious problem, but the originals survive untouched.
Slightly, in practice: ransomware actively hunts mapped drive letters. But anything the account can reach by path is equally writable. The protection is the permission level, not how the folder was opened.
The backup should pull or push using its own dedicated account with access to nothing else — and the backup destination should not be browsable from office PCs at all. If staff PCs can open the backup share and write to it, so can their malware.