We want to activate Ransomware protection on a server share (from the Endpoint protection installed on the server). Will we have to go through a painful 'learning' period where all applications are blocked, and we must allow? Or is the engine intuitive enough to recognize common legitimate applications (Excel, for example)? Also, how does the protection deal with modifications coming from the workstations that access the share?