Hi All,
I receive a lot of alerts about users downloading cracked software or key-generators. Sometimes they're blocked, sometimes they run for a minute or two then get remediated, or sometimes they fully run.
My question is, what do you guys do when you encounter users downloading these cracks/keygenerators? If it ran for 1-2 minutes do you reimage the device? Do you simply just quarantine the file and call it a day?
My thought process is, if it ran for at all for over a minute, then, reimage the device, as it's a crack/keygen and can be bundled with other goodies I could be missing.
If it didn't run, then, notify the user and remove it from the device.
Do you guys have any other insight on what could/should be done?
Most of these cracks are coming from USBs, not, downloaded directly from the internet. However, we can't restrict USB access due to the nature of our business.
Any insight would be great!
Note1:
- I appreciate all the feedback from everyone. Great to see everyone's thoughts and how they handle things.
Note2:
- My company is very reliant on Local admin rights and USBs. so, unfortunately restricting access is near impossible despite efforts to reduce the numbers. Security is trying to reduce it, however, business is against it