Preventing Bat and vbs files

Printable View

28th January 2010, 02:08 PM
BSOD

Preventing Bat and vbs files

Hi

Got a problem where our darling students keep creating bat and vbs files and saving them to their home directory. Is there a way bat and vbs files could get automatically deleted on some sort of scheduled scan. Or some other way to prevent these files from being saved in the first place?
28th January 2010, 02:18 PM
tommccann

try EduSweep
28th January 2010, 02:19 PM
mac_shinobi

for bat /vbs you could use group policy to do a black list to not allow command.com , wscript, cscript but not sure how that would effect startup / logon scripts ??
28th January 2010, 02:22 PM
maniac

Quote:

Originally Posted by BSOD

Hi

Got a problem where our darling students keep creating bat and vbs files and saving them to their home directory. Is there a way bat and vbs files could get automatically deleted on some sort of scheduled scan. Or some other way to prevent these files from being saved in the first place?

If you have Server 2003 R2 you can setup Storage Recource Manager to stop the students saving certain extensions in their home areas - we do that here with great success. You can also block Wscript and command, it doesn't seem to affect login scripts for us.

Mike.
28th January 2010, 03:11 PM
sted

Quote:

Originally Posted by mac_shinobi

for bat /vbs you could use group policy to do a black list to not allow command.com , wscript, cscript but not sure how that would effect startup / logon scripts ??

cant you block them running from certain locations (so say d/e/f/u assuming u = users area d/e/f are cd/pen)
28th January 2010, 03:13 PM
mac_shinobi

Quote:

Originally Posted by maniac

If you have Server 2003 R2 you can setup Storage Recource Manager to stop the students saving certain extensions in their home areas - we do that here with great success. You can also block Wscript and command, it doesn't seem to affect login scripts for us.

Mike.

I was thinking about that but I couldnt recall what it was called nor how to set it up so didn't want to suggest that.
28th January 2010, 03:14 PM
mullet_man

We use the Software Restriction Policy, to disallow

*.bat
*.cmd
etc

but need to allow \\server\netlogon\*.bat
etc

so logon scripts run.
28th January 2010, 06:18 PM
mac_shinobi

Quote:

Originally Posted by mullet_man

We use the Software Restriction Policy, to disallow

*.bat
*.cmd
etc

but need to allow \\server\netlogon\*.bat
etc

so logon scripts run.

Would that be a point of failure because if they can get to the sysvol / netlogon or where ever ( depending on permissions of course ) they may be able to run scripts from there ?