Windows Server 2025 / How to Configure FSRM Quotas and File Screening

File Server Resource Manager (FSRM) manages folder quotas and filename-pattern screening. Apply each feature to a separate new NTFS lab folder so you can distinguish access denial, quota exhaustion, and a screening rule.

Check NTFS and dedicated test folders

Create empty D:\QuotaLab and D:\ScreenLab on FS1 instead of unexpectedly restricting departmental data. FSRM support guidance states the ReFS limitation; verify the file system first.

Get-Volume -DriveLetter D | Select-Object DriveLetter,FileSystem
Install-WindowsFeature FS-Resource-Manager -IncludeManagementTools
Get-Service SrmSvc

Install in elevated Windows PowerShell and open fsrm.msc. Successful feature installation does not grant folder write permission. Perform the local comparison with an account that can write to these folders.

Apply a hard quota to one folder

1. Under Quota Management → Quota Templates, create Lab-50MB.
2. Set a 50 MB hard limit; hard quotas block excess storage while soft quotas monitor without enforcing the cap.
3. Create one quota for D:\QuotaLab using that template, rather than automatic quotas on child folders.
4. Inspect its exact path, limit, and usage.

A folder quota differs from per-user NTFS disk quotas. quota creation guidance distinguishes template-based and automatic application. For real folders, assess current usage, growth, retention, and notification before enforcement.

Compare writes below and above the limit

Check available storage and confirm these filenames do not exist. The following creates two small 30 MiB files within the bounded lab folder:

$sampleBytes = New-Object byte[] (30MB)
[System.IO.File]::WriteAllBytes('D:\QuotaLab\first.bin',$sampleBytes)
[System.IO.File]::WriteAllBytes('D:\QuotaLab\second.bin',$sampleBytes)

Under the 50 MB hard cap, verify that the first succeeds and the second fails for quota exhaustion. Correlate the error with FSRM usage. If both fail, check paths, rights, and physical space. Inspect whether a failed attempt left a partial file.

A soft quota allows the comparison write above the same limit. Keep the test bounded and restore the chosen settings afterward. Alerts require configuration; a quota does not automatically configure working email.

Screen a harmless filename pattern

1. Create file group LabBlocked with pattern *.labblocked. No real executable or malware is needed.
2. Create a file screen for D:\ScreenLab.
3. Choose active screening and LabBlocked, adding an event notification if wanted.
4. Verify normal.txt can be saved while sample.labblocked is blocked.
5. Compare passive screening, which permits the save, and inspect only configured notifications; then restore the original setting.

file-screen guidance explains active and passive behavior. Filename screening is not content-based antimalware protection. Renamed extensions and applications using temporary files need separate consideration.

Diagnose and remove only the test rules

A failed save is not always a permission error. Inspect the path’s FSRM configuration, usage, NTFS rights, physical space, and events. A local-server test differs from an ordinary-user SMB test.

Remove only QuotaLab’s quota and ScreenLab’s screen when finished, then verify normal saves. Clean up only the test files. Before deleting templates or file groups, check other references rather than propagating a lab change across operational folders.