Can access to shadow copies be restricted?

Question

I would like to lock down access to shadow copies (previous versions) so that typical users cannot access them. I can think of two strategies to accomplish this.

1. Block network access to shadow copies. Shadow copies can only be accessed from the server itself, not over file shares.
2. Restrict access to shadow copies to server administrators.

Please note: while I can modify the policy on the server with gpedit.msc, I do not have any control over GPO from Active Directory so I can't push any settings to clients.

Answer 1

Hi GavenRay,

Thank you for posting in the Microsoft Community Forums.

1. Block network access to Volume Shadow Copies

Goal: Ensure that Volume Shadow Copies can only be accessed from the server itself and not via file shares.

Implementation:

Configure firewall rules: set up rules in the server's firewall to block network access to the Volume Shadow Copy storage location. This can be accomplished by defining inbound and outbound rules to ensure that only specific services or IP addresses can access these locations.

File share permissions: If the Volume Shadow Copies are stored on a file server and these files are shared over the network, then you need to ensure that the share permissions are set so that only the server administrator can access them. This can be done by configuring permissions in the file share properties.

Caution:

You need to ensure that firewall rules do not interfere with the normal operation of the server and other necessary network services.

If the Volume Shadow Copy is stored in multiple locations, you need to configure each location accordingly.

2. Restrict access to the Volume Shadow Copy to the server administrator.

Goal: Ensure that only server administrators have access to Volume Shadow Copies.

Implementation Approach:

File system permissions: set permissions on the file system to ensure that only the Server Administrators group or a specific user can access the Volume Shadow Copy storage location. This can be accomplished by right-clicking on a folder or file, selecting Properties, and then configuring permissions in the Security tab.

Using Group Policy: Although you mentioned that you cannot control the GPO from Active Directory, if you are able to use local group policy (gpedit.msc) on the server, you can configure a local group policy to restrict access to the Volume Shadow Copy. Specifically, you can create a new security policy, apply it to users or groups of users on the server, and restrict their access to the Volume Shadow Copy storage location.

Caution:

When configuring file system permissions, you need to ensure that you do not accidentally prevent the server administrator or other necessary users from accessing these files.

If you are using a local group policy, you need to ensure that the policy settings do not conflict with other policies on the server.

Best regards

Neuvi

Answer 2

Could you please provide more details? I like the idea of blocking network access to VSC via firewall rules but how would I construct a rule to block VSC only and not block regular SMB access?

Answer 3

Hi GavenRay,

Blocking network access to Volume Shadow Copies (VSCs) via firewall rules without blocking regular SMB access is a challenging task indeed. Since the Volume Shadow Copy service does not usually communicate directly using specific ports, but rather relies on the underlying file system and volume management services, it is difficult to accurately block access to it through simple firewall rules.

However, here are some possible solutions and recommendations that can help you accomplish this:

1. Deepen your understanding of VSC communication mechanisms

First, you need to gain a deeper understanding of the communication mechanism of the Volume Shadow Copy Service. While this may require some technical background and expertise, understanding how it works will help you develop more effective firewall rules.

2. Use dynamic port filtering

If the VSC service does use dynamically assigned ports, you might consider configuring your firewall to use dynamic port filtering. This typically involves monitoring the network traffic of the VSC service and dynamically updating the firewall rules to block unauthorized access. However, this approach can be complex and requires continuous monitoring and maintenance.

3. Restricting the scope of network access to VSC services

Another approach is to limit the network access range of the VSC service. This can be accomplished by configuring the server's network settings, for example restricting the VSC service to be accessible only from the server's local or specific internal network. This reduces the risk of unauthorized access to some extent, even if the VSC service uses ports or protocols that cannot be precisely identified.

4. Use of Application Layer Firewalls

Application layer firewalls (also known as deep packet inspection firewalls) can inspect and analyze the contents of packets in network traffic. By configuring an application layer firewall, you can create more granular rules to identify and block specific types of network traffic, such as traffic associated with VSC services. This approach may require a higher level of firewall equipment or software and an in-depth understanding of the communication protocols and characteristics of VSC services.

5. Consider using other security measures

In addition to firewall rules, you can consider using other security measures to enhance the protection of VSC services. For example:

Configure the server's access control lists (ACLs) to restrict access to folders or volumes where the VSC service resides.

Use file encryption to protect the data stored by the VSC service.

Regularly monitor and audit the server's security logs to detect any suspicious access attempts.

6. Consult a professional

Since this issue involves more complex network and security configurations, it is recommended that you consult a professional network security expert or IT consultant if you are unsure of how to proceed or are experiencing difficulties. They can provide more specific advice and assistance to ensure that your server and network security is properly protected.

Best regards

Neuvi

Answer 4

I'm starting to wish you hadn't replied to my question in the first place. I asked, "How do I do X?" and you replied, "Learn how to do X." This makes the question appear to be answered when, in fact, it has not.

Blocking network access to VSS via firewall rule does not prevent VSC access but that does not surprise me.

"Learn more about" and "Consult a professional" are not typically things you expect to get from a "Microsoft Agent | Moderator." If I weren't a professional, do you think I'd be asking a question this specific?