Understanding Datto EDR's Ransomware Detection

NAVIGATION  Policies

PERMISSIONS   Datto EDR subscription with administrator, analyst, or external analyst-level platform access

Datto EDR is a secure and fully-featured cloud platform that enables MSPs to remotely monitor, manage, and support their endpoints. It also provides an extra layer of security with native ransomware detection. Datto EDR's ransomware detection monitors for the existence of crypto-ransomware on endpoints by using proprietary behavioral analysis of files. Once ransomware is detected, Datto EDR can alert you, isolate the device, and attempt to stop the ransomware processes to keep the infection from spreading. When paired with Ransomware Rollback, ransomware detection offers a powerful early warning and rapid recovery system against malware.

This topic provides an overview of ransomware detection in Datto EDR and answers questions frequently asked by our partners. For details about Ransomware Rollback, refer to Working with Ransomware Rollback. For details about Enhanced Ransomware Rollback, refer to Working with Enhanced Ransomware Detection.

Key benefits

  • Know about ransomware infections instantly. Instead of waiting for a user to report the issue, Datto EDR will notify you when files get encrypted by the ransomware. You'll have more time to respond and possibly prevent the spread.
  • Easily monitor by using policy-driven configuration. The policy-driven approach of Datto EDR enables MSPs to monitor targeted devices easily and at scale for the presence of ransomware. Integrations with key MSP tools, such as Datto RMM, along with email and webhook notification options, ensure that the right resources can be immediately alerted if ransomware is detected.
  • Prevent spreading of ransomware with automatic network isolation and termination of ransomware processes. Once ransomware is detected, you can have Datto EDR isolate the affected device from the network and attempt to stop suspected ransomware processes to prevent further spread of the infection to other devices.
  • Remediate issues remotely. Devices automatically isolated from the network can still contact Datto EDR, enabling you to take effective action to resolve the issue.
  • Recover with Datto Continuity products. When Datto EDR is integrated with Datto RMM + Datto BCDR, you can quickly recover from the ransomware outbreak by restoring the device to a previous state.

Requirements

  • You must have an active Datto EDR subscription.
  • Ransomware detection must be enabled and configured. For more information, refer to Ransomware configuration options.
  • The Datto Endpoint Security agent must be installed on all endpoints you wish to monitor, and those devices must be able to communicate with your EDR instance.

IMPORTANT  If you choose to run Ransomware Detection in Datto EDR, it must be disabled in Datto RMM or RocketCyber, and vice versa.

Compatibility

Ransomware Detection is supported on Windows 10 and above and Windows Server 2012 and above. Operating system support is the same for Standard and Enhanced detection.

For more information, see Hardware and operating system requirements.

Ransomware configuration options

You'll find your ransomware detection settings on the Policies page. Clicking the name of a ransomware policy opens its Edit Policy page. From this location, the following configuration options are available.

Ransomware monitoring options

Details
Field name Definition
Name The name of the policy
Description A brief description of the policy's purpose

 

Detection Options
Field or feature name Definition
Standard Select to monitor any local drive for ransomware activity. Network drives, removable drives, and USB mass storage devices are excluded from being monitored.
Enhanced Select to enable Datto Enhanced Ransomware Detection Monitoring. Enhanced ransomware detection uses low-overhead telemetry from the Datto Rollback service to attribute file activity to specific processes, identify attacks after fewer files are encrypted, and terminate or block the entire malicious process chain. For more information, see Working with Enhanced Ransomware Detection.

IMPORTANT When Enhanced ransomware detection is enabled, Datto Rollback service components are deployed to monitored endpoints, even if File Recovery is set to Disable. In this configuration, the Rollback service runs in a low-overhead monitoring mode. It provides process telemetry to the detection engine but does not retain file history, so file recovery is unavailable. As a result, Rollback service components, including the Rollback Driver Desktop application, are installed on endpoints monitored by a policy with Enhanced ransomware detection enabled.

 

Response Options
Feature name Definition
Kill Process When enabled, Datto EDR attempts to terminate malicious processes as soon as they are detected, helping reduce the impact of a ransomware attack.
When Enhanced ransomware detection is enabled, Datto EDR also attempts to terminate the suspected ransomware process's parent and grandparent processes and prevents the malicious process from restarting.
Isolate Host When selected, if ransomware is suspected on a host, the agent will automatically isolate the endpoint from all network connections except for the EDR portal. If this response is successful, Automatically shutdown infected systems will not execute.
Shutdown When selected, in the event of a ransomware attack, EDR can automatically attempt to shut down infected systems. If Isolate Host or Kill Process are also enabled, EDR will attempt to complete those steps first. If Isolate Host is successful, the shut down response will not execute.

File Recovery options

There are four File Recovery options available.

  • Disable: Select to prevent file recovery (rollback) on endpoints monitored by your ransomware policy. No file history is kept, and rollback is not available. Note: If Enhanced ransomware detection is enabled, Datto Rollback components are still deployed to monitored endpoints and operate in a low-overhead monitoring mode that supports enhanced detection. To prevent installation of Datto Rollback on a specific endpoint, see Controlling Ransomware Rollback installation in Working with Ransomware Rollback.
  • Rapid Recovery: Select to deploy the Rollback agent and Rollback Driver Desktop application to all endpoints monitored by the ransomware policy. Rollback runs in a low-overhead monitoring mode that supports Enhanced ransomware detection without tracking file changes or maintaining file history. When EDR detects early signs of an attack, Rapid Recovery automatically begins full tracking, recording all file operations across the disk until the suspicious activity stops or a ransomware attack is confirmed. To learn how to leverage Rapid Recovery in your environment, refer to Configuring Rapid Recovery.
  • Full Disk Tracking: Select to deploy the rollback agent and Rollback Driver Desktop application to all endpoints monitored by your ransomware policy and track file changes across the disk.
  • Folders & Extensions: Select to deploy the rollback agent and Rollback Driver Desktop application to all endpoints monitored by your ransomware policy. In this configuration, the rollback agent only tracks changes for the folders and file extension types you define in the Preferences section. See Preferences below.

Include additional drives

This option is selected automatically when Rapid Recovery, Full Disk Tracking, or Folders & Extensions are selected. This tracks changes with the Rollback Agent on any local fixed drive. Network drives, removable drives, USB-attached drives, and FAT32-formatted volumes are excluded from monitoring.

Preferences

When Folders & Extensions is selected as the File Recovery option, you can configure the file types and folders available for recovery as described below.

Preferences
Feature name Definition
Standard User Folders Select to track changes with the Rollback Agent within the user profile folders on the endpoint (the Users directory, which includes Desktop, Documents, and Downloads).
Documents Select to track changes for the following file extensions (pdf, doc, docx, xls, xlsx, ppt, pptx, odt, ods, odp, txt, rtf, md, tex, csv)
Images Select to track changes for the following file extensions (jpg, jpeg, png, gif, bmp, tif, tiff, svg, heic, heif)
Audio/Video Select to track changes for the following file extensions (mp3, wav, aac, flac, mp4, avi, mkv, mov, wmv)
Archives Select to track changes for the following file extensions (zip, rar, 7z, gz, tar, tar.gz, tgz)
Code Scripts Select to track changes for the following file extensions (py, js, html, htm, css, json, xml, sh, bat, ps1)
Custom Extensions In the Custom Extensions section, you can specify additional file extension types that you would like the rollback agent to track.
1. In the Custom Extensions field, enter the extension type. Do not enter a period before the extension.
2. Click Add. The extension is added.

Choosing a File Recovery option

Choosing the right File Recovery option depends on the endpoint's role, available resources, and acceptable gaps in file history. The following table compares key factors to help you choose the appropriate option.

A quick way to choose a File Tracking option is to consider the endpoint's recovery needs:

  • If the endpoint needs detection only, choose Disable.
  • If you want low everyday overhead with file recovery, choose Rapid Recovery.
  • If certain folders and file types must always have a record, and the rest can go without, choose Folders & Extensions.
  • If the endpoint holds systems or data where you cannot accept any gap in the record, choose Full Disk Tracking.

Cache configuration options

Cache configuration is available only when Full Disk Tracking or Folders & Extensions are selected.

Tracking cache size
Feature name Definition
Maximum Tracking History By default, Datto Rollback retains file change history for a rolling seven-day period, which is the maximum retention period. To reduce the retention period, select a lower value from the drop-down list. The actual retention period may be shorter if disk activity is high and the rollback cache reaches capacity.

Cache Size Type

 To track file changes and undo ransomware infections, the rollback agent creates a cache folder on each protected volume in which it stores historical file information. Once the cache space is exhausted, the agent will begin to purge the oldest file history. The value you specify here will be used for all monitored disks.

  • Relative: The rollback agent will reserve the percentage of the disk's total size that you specify in the Volume Capacity Percentage field for its cache. By default, the agent attempts to allocate 5% of the disk's total size to the cache. The value must be between 2% and 20%. For example, 5% of a 500 GB volume.

  • Absolute: The rollback agent will reserve the fixed amount of disk space you specify in the Absolute Size field. You must allocate at least 1 GB to the cache.

FAQs

Setting up ransomware detection is as easy as enabling it from the Policies page in your EDR portal. To get started, refer to Working with the Policies page.

Ransomware detection is designed to work alongside other security products you deploy to your customer endpoints.

Device isolation can be reverted by running the Host Isolation Restore extension from the Alerts page. Doing so will revert any isolation that has occurred on a device and return its ability to contact the internet and other devices on the network. Refer to Responding to alerts.

The ransomware detection log is stored on protected endpoints at %SYSTEMDRIVE%\ProgramData\Datto\Datto Rollback Driver\Logs\engine.log. Lines containing RWA PATTERN DETECTED indicate scans where ransomware detection identified a potential threat. A companion log, wrapper.log, in the same folder records agent-side communication and response activity.

You can also view details about ransomware alerts from your EDR portal. For more information, refer to Working with the Alerts page.

 

Revision Date
How should I format exclusions? Edited answer. 6/18/25
Changed Supported operating systems to Compatibility: Edited - Ransomware Detection supports Windows 10 and above and Windows Server 2012 and above. 11/18/25
Global review, edits. 12/17/25
Technical review against agent source: documented Rollback service deployment in low-overhead mode when Enhanced detection is enabled with File Recovery disabled; corrected detection log guidance (RWA PATTERN DETECTED, wrapper.log); clarified transient-file wait, minimum encrypted-file size, drive exclusions (USB/FAT32), and cache retention maximum; fixed typos. 8/5/26

Updated link: Datto EDR's ransomware detection simulation package.

10/8/26