FSRM file screen missing double extensions

Vikram Singh 80 Reputation points
2026-09-15T06:46:23.3166667+00:00

I’ve noticed this behavior where an FSRM file screen configured to block known ransomware extensions fails to catch files using double extensions like .pdf.crypto.

Windows correctly detects and blocks single‑extension threats, finds and applies file screen templates, logs matching events in the File Server Resource Manager console, but still allows files with compound extensions to slip through. Event Viewer confirms the file screen triggers only on the last extension segment, meaning .crypto is recognized but .pdf.crypto bypasses pattern matching.

Is there a way to optimize pattern matching in FSRM to detect these chained extensions or enforce stricter filename parsing rules ?

Windows for business | Windows 365 Business
0 comments
Answer accepted by question author
HLBui 12,380 Reputation points Independent Advisor
2026-09-15T07:45:51.2466667+00:00

Hi Vikram Singh

FSRM’s default pattern matching logic only looks at the last extension segment, so .pdf.crypto slips through because it treats .crypto as the only extension. To tighten this up, you can switch to custom pattern matching using wildcards or regex‑style filters. For example, adding patterns like *.pdf.*crypto or *.*crypto helps catch chained extensions. Also, make sure your file screen templates are updated and applied at the correct scope (volume or path level), since older templates sometimes don’t refresh properly after edits.

If you’re running this on Server 2019 or later, you can combine FSRM with Antimalware Scan Interface (AMSI) or Defender’s controlled folder access for deeper inspection that’s usually more reliable for ransomware‑style naming tricks.

Don't forget to share your experience with "Accept the answer" . That others in community with similar issues can benefit from the guidance. Thank you!

Was this answer helpful?

1 person found this answer helpful.
0 comments

1 additional answer

Sort by: Oldest
Most helpful Newest Oldest
  1. HLBui 12,380 Reputation points Independent Advisor
    2026-09-17T16:11:13.51+00:00

    If you find this helpful, Kindly mark "Accept Answer", so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated. Thank you!

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.