Ransomware in SMBs: Prevention on the Endpoints

Ransomware can paralyze an SMB in a matter of hours: files encrypted, operations halted, backups targeted, ransom demanded. For many small organizations, the incident directly threatens the survival of the business. In the vast majority of cases, the attack begins on a workstation — a booby-trapped attachment, an Office macro, a downloaded executable, fake software. That is where, on the endpoints, most of the prevention is won or lost.

The good news is that ransomware is not magic: it reuses known techniques, exploits weak configurations, and spreads by taking advantage of over-broad rights. Closing these doors does not require buying an expensive new solution, but making proper use of the protections already included in Microsoft Defender and manageable through Intune. A well-tuned, layered defense is enough to make most attacks fail before they ever reach your data. The key word is layered: no single control stops every attack, but each one you add removes another path the ransomware relies on, and the combination is what turns a likely disaster into a blocked attempt.

Close the classic entry points

Ransomware almost always reuses the same techniques to execute and spread. Microsoft Defender's Attack Surface Reduction (ASR) rules block exactly these behaviors before they cause damage, without relying on a known signature.

• Block Office macros from launching child processes.
• Block executable content received via email and instant messaging.
• Block credential theft from the lsass system process.
• Block executables that fail trust or prevalence criteria.
• Block process creation from PSExec and WMI commands.

Deploy ASR rules without breaking production

Each ASR rule can be enabled in audit mode before switching to block. This step is crucial: it shows you what would be blocked without yet preventing it, letting you spot a legitimate business app that would trigger a false positive. You then move each rule to block once the ground is verified, keeping the option to add targeted exclusions rather than disabling the whole rule.

Reduce the surface and limit spread

Blocking the entry is not enough: you must also limit what a compromised endpoint can reach and prevent the attacker from spreading across the fleet. Four measures dramatically reduce the impact of a successful intrusion.

• Defender with real-time, cloud, and tamper protection enabled.
• Automatic Windows and app updates, with no gap left to chance.
• Least privilege: no permanent admin rights for users.
• Ransomware protection (controlled folder access) on sensitive files.

A user without admin rights cannot disable the antivirus or install malware machine-wide. An up-to-date endpoint cannot be exploited through a known flaw. A compartmentalized account does not hand over the keys to the whole network. These simple measures break the attack chain in several places, which is often enough to make the ransomware fail.

Backups: your last line of defense

Do not forget your backups either, the last line of defense when everything else has failed. Ransomware actively hunts for backups and tries to destroy them to force you to pay. Regular backups, isolated from the network and actually tested for restoration, turn an attack into a simple recovery rather than a negotiation. Combine them with your endpoint protections: the less chance ransomware has to execute in the first place, the less you will lean on your backups — but their existence remains your ultimate guarantee of getting the business running again.

• Apply the 3-2-1 rule: three copies, on two media types, one of them off-site.
• Isolate at least one copy from the network, out of reach of a compromised account.
• Test restoration regularly, because a backup never tested is only a hypothesis.
• Watch for mass file-deletion attempts, an early signal of an attack.

A concrete example

An accountant at an SMB receives a fake invoice as a Word document. They open it and enable macros as the document requests. On an unprotected machine, the macro downloads and launches the ransomware payload, which starts encrypting shared files and tries to spread using credentials found in memory.

On a properly hardened machine, the scenario stops dead. The ASR rule that prevents Office macros from launching a child process blocks the download. Even if the payload ran, the user has no admin rights, Defender blocks the untrusted executable, and credential theft from lsass is neutralized. The attack never reaches the encryption phase. The same email, the same human error, but a radically different outcome. And because controlled folder access guards the shared documents, even a payload that slipped through could not silently rewrite them. Not one of these layers is expensive or exotic; they simply have to be switched on and enforced consistently across every machine, which is exactly where a centralized approach pays off.

Common mistakes to avoid

Anti-ransomware protection often fails on operational details rather than on a lack of tools. Here are the most common pitfalls in SMBs.

• Leaving permanent admin rights on user accounts for convenience.
• Enabling ASR rules straight into block mode without an audit phase, then disabling them at the first false positive.
• Postponing updates, leaving known flaws exploitable for weeks.
• Keeping backups online and reachable from production accounts.
• Never testing restoration and discovering on the day that the backups are unusable.

How AuPoint hardens your endpoints

AuPoint is a SaaS that makes Intune security and compliance easy, with no PowerShell. The platform deploys ASR rules, Defender, update management, and least privilege in a few clicks, with recommended and tested settings, an impact preview before applying, and one-click rollback — with no risk of breaking production. You get coherent anti-ransomware protection across the whole fleet, aligned with ISO 27001 and NIS2, without writing a single line of PowerShell.

Frequently asked questions

Could ASR rules block my line-of-business apps?

It is possible for a few apps that use techniques similar to those of malware. That is why audit mode is essential: it reveals these cases before any block. You then add a targeted exclusion for the affected app rather than disabling the rule for everyone.

Does least privilege really get in users' way?

Day to day, most tasks need no admin rights at all. For the rare one-off needs, a controlled, temporary elevation is enough. The security gain is considerable: a compromised standard account sharply limits what an attacker can do on the machine and across the network.

Should I pay the ransom if the attack succeeds?

Authorities strongly advise against paying: nothing guarantees you recover the data and it funds criminal activity. With isolated, tested backups, you restore without negotiating. That is precisely why endpoint prevention and a backup strategy go hand in hand.

Connect your Microsoft tenant to AuPoint and harden your endpoints against ransomware in minutes, with an impact preview and guaranteed rollback, no PowerShell. Start free at aupoint.io.