You can quickly apply the deny execute special permission to the students group to the home folders, this way they cannot execute software from the home shares.
However, setting up software restriction policies is essential, i think i may have gone overkill in my setup of SRP however no one, thats no one can install anything i dont allow
If you remove the execute permission from folders you can't open them. Make sure you only remove the execute permission on files.
:-O i didnt know that
XP SP2 has no outbound protection. There's API's that the program running on the machine can use to open ports for incomming connections. So no, its no help.
There's also the Becta-preffered method of stopping this thing (although it's less effective) using School policies - threatening to remove an a-level kid's login will mean that they can no longer do their work and this effectively means they lose their place at the school.
Speak to your SMT to see how policies could be implemented.
We've used GPO and folder security settings (deny execution of files) to block running of exe's.
You'll then find the kids will start running exe's from their USB drives (if, like us, you haven't blocked them from using USB drives).
All we did then was install a program to make sure that their USB drive installed as Z:, Y:, or X: (in case they tried to install more than one drive) and prevented running of exe's via GPO.
The little darlings will find ways around that, too, I'm sure
.... You say you installed a program? People want details
I installed a piece of freeware called USB Drive Letter Management, which allows you to specifiy what letter a USB device gets when it is plugged in, then I crudely had to add into the Software Restrictions in GPO deny *.exe, then *.*\*.exe, then *.*\*.*\*.exe.... for a good few levels as there's no way to specify the whole drive. The students could get round it if they put an exe in a deep enough subfolder, but I'm hoping they'd give up before getting that far
Hmmm. Googling for "USB Drive Letter Management" returns a a big fat zero hits. Can you remember where you got it from?Originally Posted by Richie_OLSJ
Would it be USBDLM (USB Drive Letter Manager)???
I have to say, I think you're going about it back to front. Its much easier to deny everything then put in a whitelist of files you want run than it is to blacklist everything you don't want run. As long as you allow anything in Program Files and a couple of other choice directories (Kudos for example) you're laughing.I installed a piece of freeware called USB Drive Letter Management, which allows you to specifiy what letter a USB device gets when it is plugged in, then I crudely had to add into the Software Restrictions in GPO deny *.exe, then *.*\*.exe, then *.*\*.*\*.exe.... for a good few levels as there's no way to specify the whole drive. The students could get round it if they put an exe in a deep enough subfolder, but I'm hoping they'd give up before getting that far
There are all sorts of exe's running - yes, a lot in program files, but also other places - i'd rather not develop huge lists of programs to exclude from the list and simply block the areas where i know they shouldn't be running exe's
I'm sure I have added drive letters to Software Restriction Policies.......
fooby
You can add drive letters, however, something like: p:\*.exe only blocks exe's in the root, you have to specifiy a block on each level through the directory structure in software restrictions
Add a new path rule as follows to stop exe's etc from running in a users homefolder and subfolders:-
%homeshare%*
There are currently 1 users browsing this thread. (0 members and 1 guests)
Posting Permissions
LinkBack URL
About LinkBacks