How to Contain Ransomware Incidents Across Multiple Clients. It starts with a single alert. Then another. Then ten more, all at once, across different clients and networks. Ransomware doesn't wait, especially when it hits a multi-client environment. In this video, we'll explain how to contain ransomware across multiple client environments— and why immediate containment matters. Before we begin, be sure to subscribe to NinjaOne's IT video hub and our YouTube channel for more tech content like this. Why Ransomware Containment Matters. For managed service providers, a ransomware incident is never just one problem. Every compromised endpoint becomes a pivot point into the next client's network. Delayed responses multiply the damage, turning isolated breaches into coordinated, multi-tenant disasters. Containment is possible, but it demands a plan, executed in minutes. The First 30 Minutes of Ransomware Triage. The decisions you make in the first thirty minutes determine everything. Watch for these signs: File extensions changing en masse Unexpected CPU spikes caused by encryption activity Unusual outbound traffic to command-and-control servers Widespread login failures or app crashes across client accounts Prioritize production systems and revenue-critical operations; development and testing environments can tolerate more downtime. Also, before containment alters any system state, collect forensic evidence for any legal, regulatory, or insurance follow-up. How to Contain Ransomware Incidents Quickly. Once you've triaged, it's time to contain. Enforce firewall rules, disable compromised accounts, and cut off suspicious IP ranges across all client environments. Use VLAN reconfiguration and switch port disabling to isolate affected systems without requiring on-site personnel. For lateral movement, go straight to Active Directory. Reset service account passwords and let network access control systems quarantine suspicious devices automatically. Windows Defender — Step-by-Step Protection. Microsoft Defender Antivirus already provides powerful built-in ransomware protection, deployable across client endpoints. Here's how to configure it. Open "Windows Security" from the Start menu and navigate to "Virus & Threat Protection." Under "Manage Settings," toggle on "Real-Time Protection" and "Cloud-Delivered Protection." These are your baseline defenses. For more granular protection, back in "Virus & Threat Protection," select "Ransomware Protection" and then "Manage Ransomware Protection." Turn on "Controlled Folder Access." This helps prevent unauthorized or untrusted applications from modifying protected folders such as Documents and Pictures. Also, under "Controlled Folder Access," select "Allow an App Through" to whitelist trusted applications. For antivirus exclusions, navigate to "Virus & Threat Protection Settings" and then "Exclusions." Only add exclusions where strictly necessary. Lastly, enable Network Protection to help block connections to malicious command-and-control infrastructure, phishing sites, and other known malicious domains. Under Windows Security, go to App & Browser Control, then Reputation-Based Protection Settings, and enable Network Protection. If that option isn't visible, open PowerShell as administrator and run this command: Set-MpPreference -EnableNetworkProtection Enabled To conclude, ransomware is sophisticated, coordinated, and fast—but so is a prepared MSP with the right tools, protocols, and mindset. Triage with precision, contain with speed, and protect with consistency. Because when every second counts, your clients are counting on you. For more information, check out our official blog post on ransomware containment in multi-client environments, linked in the description below.