prevent running .exe from ZIP files

[theaman]

I am the network manager in a school. 2003 and xp domain.

I can prevent exe files from running Ok. But when a student double clicks on an exe file from within a ZIP it runs ok. I have tried to prevent running ZIP files but could not stop them. by Using security settings in a GPO.

Using Software Restriction Policies to Protect Against Unauthorized Software

Any thoughts on preventing these exe from running.

Thanks

[k-strider]

i got around this by setting the policy to not run any EXEs by default, and then enabling the running of EXEs (exceptions) from %windir% %programfiles% any network location that requires them.

i tried at one stage to prevent this too but the zip runs the exe from the users temp folder which would be in the %appdata% folder. in the end i bit the bullet and disabled the running of exes and vbs and cmd etc etc and just making a list of exceptions only around 20

Software Restriction Policies/Security Levels
Policy Setting
Default Security Level Disallowed
Software Restriction Policies/Additional Rules
Path Rules
%LOGONSERVER%\NETLOGON
Security Level Unrestricted
Description
Date last modified 29/02/2008 10:45:30
%logonserver%\sysvol
Security Level Unrestricted
Description
Date last modified 29/02/2008 11:24:07
%programfiles%
Security Level Unrestricted
Description
Date last modified 29/02/2008 10:58:56
%windir%
Security Level Unrestricted
Description
Date last modified 29/02/2008 11:03:39
\\Myserver\netlogon
Security Level Unrestricted
Description
Date last modified 29/02/2008 11:35:12
\\Myserver\sysvol
Security Level Unrestricted
Description
Date last modified 29/02/2008 11:35:21
\\mydfs\dfs\programs
Security Level Unrestricted
Description
Date last modified

[theaman]

I will give it a go

thanks

[webman]

When EXEs are ran from within ZIP files, I think they get copied to %temp% - so restricting this folder should work.

[Michael]

You should in theory be able to prevent ZIP files opening just as you would exe's.

[theaman]

Thanks all that's done the trick

[AlexB]

Be careful with restricting exes in the %temp% folder, we had a problem with some older serif software not working because it copied stuff to the %temp% folder to run