Windows Storage Spaces as Home NAS: Ransomware Risk and Hardening
Storage Spaces turns a Windows box into a NAS-like storage pool. What ransomware does to it, what Windows Defender can and cannot stop, and the 8 steps that make it survivable.
What it does
Pricing
Good at
- Households that already run Windows 24/7
- Reusing spare disks as a storage pool
- One license, no NAS hardware
Not for
- Low-power always-on storage (a NAS draws 20–40 W; a desktop draws 80–200 W)
- Households without a Windows license
Key features
- Software RAID (simple/mirror/parity) built into Windows
- ReFS or NTFS on top
- Defender + BitLocker built in
- RDP/SMB exposed if you enable remote access
The real risks
One OS, one attack surface. The NAS OSes (DSM, QTS, ADM, TOS) ship hardened defaults and an auto-updater; Windows ships with SMBv1 off but RDP, PowerShell remoting, and 20 years of legacy services. A Windows box is a bigger attack surface than a purpose-built NAS.
Ransomware runs as you. On a NAS, the ransomware has to find an entry (SMB exploit, exposed port, stolen admin). On a Windows box, a phishing click is often enough — ransomware runs with your user rights and encrypts everything you can read, including the Storage Spaces pool.
No snapshot layer by default. Synology/QNAP snapshots are on by default or one click away. Windows needs VSS (Volume Shadow Copy) scheduled and sized by you — most households never turn it on, which is why ransomware on Windows is so destructive.
Mapped drives encrypt together. If the Windows box maps the NAS shares (or vice versa), one infection takes down both. Segment them: do not leave the NAS admin share mapped on the Windows box.
Cloud-synced encryption. OneDrive/Dropbox sync encrypts the cloud copy too. Turn on Files On-Demand or versioning, or accept that the cloud copy is gone when the local pool is encrypted.
Hardening steps
- Enable VSS (shadow copies) on the pool and size it generously (10–20% of the volume); schedule daily snapshots — this is your free undo.
- Keep an immutable copy: use Veeam Agent's WORM snapshot, or a NAS-side Hyper Backup/HBS 3 pull — never a push from the Windows box to the NAS with admin rights.
- Turn off RDP and PowerShell remoting unless you actually use them; if you must, put them behind a VPN (Tailscale is free for up to 100 devices).
- BitLocker the pool; keep the recovery key in a password manager, not on the same box.
- Turn on Controlled Folder Access in Defender (it blocks unsigned processes writing to your Documents/pool paths).
- Do not map the NAS admin share; use a read-only user for the backup push.
- Patch on Patch Tuesday, every month — Windows boxes lag NAS firmware updates in practice, and the C3RB3R outbreak showed why the lag matters.
- Test one restore per quarter. A backup you have never restored from is a hope, not a plan.
Frequently asked questions
Is Windows Storage Spaces as safe as a Synology NAS?
Not by default. The NAS OSes ship hardened and snapshot-first; Windows ships general-purpose and snapshot-off. A hardened Windows box (VSS on, RDP off, immutable backup) is survivable; a default one is not.
Can ransomware encrypt a Storage Spaces pool?
Yes — it is just a volume. The undo paths are VSS snapshots (if enabled), an immutable backup, or a NAS-side pull. Without those, the pool is gone.
Does BitLocker stop ransomware?
No. BitLocker protects a powered-off disk from theft. Ransomware running on the booted system reads and writes through BitLocker like any other process.
This page is part of the NAS security encyclopedia: 12-step hardening checklist, 3-2-1 backup rule, "Am I affected?" 60-second check.
Last updated: November 2026 · prices are US list prices at the time of writing. As an Amazon Associate we earn from qualifying purchases.