Antiransomware

Enable antiransomware to protect specific files, folders, or file types on your endpoints from unauthorized changes.

Options	Description
Protected Folders	Select the desired folders from the list, or click Add Folder to add a custom directory. Antiransomware protects all content in the selected folders against unauthorized changes. To remove a folder, select it then click the Remove Folder button.
Protected File Types	Enter the desired file types to protect from suspicious activity, separating each file type with a comma. Do not include the leading dot when entering a file type. For example, to include text files, enter `txt`, as opposed to `.txt`.
Action	When antiransomware detects suspicious activity, it displays a popup asking the user if they want to terminate the process: If the user selects Yes, FortiClient terminates the suspicious process. If the user selects No, FortiClient allows the process to continue. If the user does not select an option, FortiClient waits for the configured action timeout, then does one of the following, as configured: Block access and warn user if suspicious activity is detected: FortiClient terminates the suspicious process. Warn user and resume after the timeout: FortiClient allows the process to continue.
Action Timeout	Enter the desired timeout value.
Bypass Valid Signer	Enable FortiClient to exclude a process from the selected antiransomware action if it has a valid signer.

Enable antiransomware to protect specific files, folders, or file types on your endpoints from unauthorized changes.

Options	Description
Protected Folders	Select the desired folders from the list, or click Add Folder to add a custom directory. Antiransomware protects all content in the selected folders against unauthorized changes. To remove a folder, select it then click the Remove Folder button.
Protected File Types	Enter the desired file types to protect from suspicious activity, separating each file type with a comma. Do not include the leading dot when entering a file type. For example, to include text files, enter `txt`, as opposed to `.txt`.
Action	When antiransomware detects suspicious activity, it displays a popup asking the user if they want to terminate the process: If the user selects Yes, FortiClient terminates the suspicious process. If the user selects No, FortiClient allows the process to continue. If the user does not select an option, FortiClient waits for the configured action timeout, then does one of the following, as configured: Block access and warn user if suspicious activity is detected: FortiClient terminates the suspicious process. Warn user and resume after the timeout: FortiClient allows the process to continue.
Action Timeout	Enter the desired timeout value.
Bypass Valid Signer	Enable FortiClient to exclude a process from the selected antiransomware action if it has a valid signer.