FSRM file screen missing double extensions

Question

I’ve noticed this behavior where an FSRM file screen configured to block known ransomware extensions fails to catch files using double extensions like .pdf.crypto.

Windows correctly detects and blocks single‑extension threats, finds and applies file screen templates, logs matching events in the File Server Resource Manager console, but still allows files with compound extensions to slip through. Event Viewer confirms the file screen triggers only on the last extension segment, meaning .crypto is recognized but .pdf.crypto bypasses pattern matching.

Is there a way to optimize pattern matching in FSRM to detect these chained extensions or enforce stricter filename parsing rules ?

Answer 1

Hi Vikram Singh

FSRM’s default pattern matching logic only looks at the last extension segment, so .pdf.crypto slips through because it treats .crypto as the only extension. To tighten this up, you can switch to custom pattern matching using wildcards or regex‑style filters. For example, adding patterns like *.pdf.*crypto or *.*crypto helps catch chained extensions. Also, make sure your file screen templates are updated and applied at the correct scope (volume or path level), since older templates sometimes don’t refresh properly after edits.

If you’re running this on Server 2019 or later, you can combine FSRM with Antimalware Scan Interface (AMSI) or Defender’s controlled folder access for deeper inspection that’s usually more reliable for ransomware‑style naming tricks.

Don't forget to share your experience with "Accept the answer" . That others in community with similar issues can benefit from the guidance. Thank you!

Answer 2

If you find this helpful, Kindly mark "Accept Answer", so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated. Thank you!