> For the complete documentation index, see [llms.txt](https://docs.keeper.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.keeper.io/keeperpam/endpoint-privilege-manager/policies/policy-examples/anti-ransomware-policies/gate-3-recovery-destruction.md).
# Gate 3: Recovery-Destruction
**Audience:** Windows administrators deploying a layered Keeper EPM anti-ransomware baseline.
***
For an overview of the layered anti-ransomware model and how this gate fits in, see [Anti-Ransomware Policies](/keeperpam/endpoint-privilege-manager/policies/policy-examples/anti-ransomware-policies.md).
This policy is the **recovery-destruction gate** in a layered Keeper EPM anti-ransomware deployment on Windows. It denies execution of the canonical destructive Windows utilities — `vssadmin.exe`, `wbadmin.exe`, `bcdedit.exe`, `wevtutil.exe`, `fsutil.exe`, and `cipher.exe` — that ransomware families (Conti, LockBit, BlackCat, Royal, Akira lineage) use to delete shadow copies, destroy backups, disable boot recovery, and clear forensic evidence. By targeting the executables themselves, the policy blocks these utilities no matter where they are launched from on disk, by any user, on any in-scope machine.
## Step-by-Step: Create the Policy
{% stepper %}
{% step %}
### Create the Application Collection
Before creating the policy, the destructive utilities must be organized into an Application Collection. Filename-only resources match the executable regardless of disk location, which is what gives this policy its "path-independent" behavior.
1. From the Keeper Admin Console, navigate to **Endpoint Privilege Manager → Collections → Applications**.
2. Click **New Collection**.
3. In the **New Collection** modal:
* **Type**: `Applications`
* **Name**: `Ransomware Destructive Utilities (Windows)`
* Click **Next**.
4. In the **Add Item to Collection** modal, check **Manually define resource** to add each utility as a custom resource.
5. Add each of the following entries, one at a time, clicking **Add** after each:
1. `vssadmin.exe`
2. `wbadmin.exe`
3. `bcdedit.exe`
4. `wevtutil.exe`
5. `fsutil.exe`
6. `cipher.exe`
6. Save the collection. Note the collection's UID — you will reference it in `ApplicationCheck` when importing the policy JSON, or select it from the picker when creating the policy in the UI.
{% hint style="info" %}
**Why filename only:** A resource entered as `vssadmin.exe` (without a path) matches that executable wherever it is launched from — `C:\Windows\System32`, a copy staged under `%TEMP%`, a renamed-folder dropper, or a USB stick. A resource entered as `C:\Windows\System32\vssadmin.exe` would only match that one literal path and miss any staged copy.
{% endhint %}
{% endstep %}
{% step %}
### Create the Policy
1. Navigate to **Endpoint Privilege Manager → Policies** and click **Create Policy**.
2. Fill in the policy details:
* **Policy Name**: `Deny Ransomware Recovery Destruction (Windows)`
* **Policy Type**: `File Access`
* **Status**: `Monitor` for the initial pilot. Switch to `Enforce` once you have confirmed no legitimate admin or backup tooling is matching these patterns.
{% endstep %}
{% step %}
### Add the DENY Control
1. Click **Add Control**.
2. Select **Deny**.
{% endstep %}
{% step %}
### Set Filters
1. **User Groups**: Select **All Users and Groups** (wildcard).
2. **Machine Collections**: Select your Windows machine collection. If you want this policy to behave as a baseline that any specific Allow policy can override, leave this as **Select All**. If you want it to take specific-policy precedence, target a named Windows machine collection instead.
3. **Applications**: Select the `Ransomware Destructive Utilities (Windows)` collection created in Step 1.
4. Leave **Date & Time Window** unset — destructive ransomware activity should be denied at any hour.
{% endstep %}
{% step %}
### Set the Notification in Advanced Mode
1. **Notification Message**: `This action has been blocked by Keeper EPM. The requested utility is restricted because it is commonly used to destroy backup and recovery data. Contact your administrator if you have a legitimate business need.`
{% endstep %}
{% step %}
### Save and Pilot
1. Click **Save**. The policy is pushed to all in-scope endpoints within approximately 30 minutes; users on affected endpoints can trigger an immediate sync via **Refresh Policies** in the Keeper agent.
2. Run in **Monitor** mode for 7–14 days. Review the audit log in **Endpoint Privilege Manager → Dashboard** for any matches against legitimate administrative or backup workflows.
3. When monitoring is clean, edit the policy and change **Status** to `Enforce`.
{% endstep %}
{% endstepper %}
## Reference: Policy JSON
The following JSON is the exported form of the finished policy. The `` and `` placeholders are filled in by the Admin Console when the policy and collection are created.
```json
{
"PolicyName": "Deny Ransomware Recovery Destruction (Windows)",
"PolicyType": "FileAccess",
"PolicyId": "",
"Status": "enforce",
"Actions": {
"OnSuccess": {
"Controls": [
"DENY"
]
},
"OnFailure": {
"Command": ""
}
},
"NotificationMessage": "This action has been blocked by Keeper EPM. The requested utility is restricted because it is commonly used to destroy backup and recovery data. Contact your administrator if you have a legitimate business need.",
"NotificationRequiresAcknowledge": false,
"RiskLevel": 95,
"Operator": "And",
"Rules": [
{
"RuleName": "UserCheck",
"ErrorMessage": "This user is not included in this policy",
"RuleExpressionType": "BuiltInAction",
"Expression": "CheckUser()"
},
{
"RuleName": "MachineCheck",
"ErrorMessage": "This Machine is not included in this policy",
"RuleExpressionType": "BuiltInAction",
"Expression": "CheckMachine()"
},
{
"RuleName": "ApplicationCheck",
"ErrorMessage": "This application is not included in this policy",
"RuleExpressionType": "BuiltInAction",
"Expression": "CheckFile(false)"
},
{
"RuleName": "DateCheck",
"ErrorMessage": "Current date is not covered by this policy",
"RuleExpressionType": "BuiltInAction",
"Expression": "CheckDate()"
},
{
"RuleName": "TimeCheck",
"ErrorMessage": "Current time is not covered by this policy",
"RuleExpressionType": "BuiltInAction",
"Expression": "CheckTime()"
},
{
"RuleName": "DayCheck",
"ErrorMessage": "Today is not included in this policy",
"RuleExpressionType": "BuiltInAction",
"Expression": "CheckDay()"
},
{
"RuleName": "CertificateCheck",
"ErrorMessage": "Certificate hash is not included in this policy",
"RuleExpressionType": "BuiltInAction",
"Expression": "CheckCertificate()"
}
],
"UserCheck": [
"*"
],
"MachineCheck": [
"*"
],
"ApplicationCheck": [
""
],
"DayCheck": [],
"DateCheck": [],
"TimeCheck": [],
"CertificationCheck": [],
"Extension": {}
}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.keeper.io/keeperpam/endpoint-privilege-manager/policies/policy-examples/anti-ransomware-policies/gate-3-recovery-destruction.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.