We have tried setting 'windows.advanced.ransomware.canary' to false but shortly after a new Windows workstation agent is enrolled we are still seeing the pair of canary directories created. We do not have a 'Platinum' account, so ransomware protection isn't even enabled. Is it possible to prevent th…

Is it possible to disable elastic defend ransomware canary?

bobr March 6, 2025, 4:23pm 3

Thank you! This worked and removed the directories without needing to uninstall/reinstall the agents.

1 Like

Topic		Replies	Views
Ransomware protection Elastic Security	7	1705	July 7, 2024
Which folders should be excluded in case of any Endpoint protection client? Logstash elastic-stack-security	1	1861	July 6, 2017
Protecting Against Attacks that Hold Your Data for Ransom Elasticsearch	3	442	February 21, 2017
Suspicious File Alert Elasticsearch	5	1913	July 5, 2017
Disable shield plugin? Elasticsearch	9	8735	July 5, 2017