Hello Geeksters!....I have a problem at my school. I uninstalled MSN messenger and all games from our systems, but these kids are reinstalling some hacked version of messenger that bypasses all secrity settings. Is there a way to stop any .exe fron beling launched from default home drives or usb sticks?
If you have 2003 R2, you can apply rules to the home folders to stop EXEs being stored there in the first place, and it e-mails you every time someone tries to save one, works a treat!
As for USB sticks, I believe you can use a section of active diectory to control the areas they are allowed to launch programs from. Use the USB drive letter manager software to control what drive letter is used for your USB sticks, and disallow that drive for execution of programs.
This topic has been covered extensively before if you do a search. Like maniac says the File screen features of R2 are great for home folders and for USB drives use the program USBDLM combined with software restriction policies will sort them out.
We set this is software restrictions in GP and works great. Just add in d: e: f: g: and thier home drive. Will work a treat. Also, you may want to block the local temp folders as running exe's can add files to there.Originally Posted by augustm
Rather than trying to block particular locations, it can be easier and more secure to just allow the locations you want executables to be launched from (eg C:\Program Files, C:\Windows)
If its JUST the home folder you want to stop it happening in then you can also set special permissions on their folders to stop them running programs.
If you are talking about removing the 'execute' NTFS permissions then I don't think it will work. If a student is able to copy a file into their home folder then as the creator of the file, then implicitly have the permission to change the permissions on it. That means that although the file may inherit a set of permissions that does not include the execute permissions, the student cannot be prevented (other than by hiding the interfaces) from changing the permissions on that file.
True. We have 'right-click' and the command prompt disabled for all students. This gets around the problem for all but the smarter students and at that point they're smart enough to realise that they can and will be caught in the end.
As another thread says, how far do you take security. No something to start in this thread.
We're not currently using the file screening in R2 as we've just moved our user areas over to an R2 server. But does R2 screening look within compressed files? For example if a student has an exe in a zipped file would they be able to run that file or would R2 pick it up?
Unsure. I just block zipped files as well
Yes we needed to block zips aswell as it runs it from the temp directory...
c:\windows\temp
I thought they also ran from %TEMP%.
If the zip extracts to temp then it will get around file screening this is where software restriction comes in.
There are currently 1 users browsing this thread. (0 members and 1 guests)
Posting Permissions
LinkBack URL
About LinkBacks
Reply With Quote