Blocking .exe

[lee_sri]

Could someone point me in the direction of blocking .exe files running on our network.

We are running Server 2003 and XP clients.
There are two places that .exe's are aloud to be run
- C drive (kids can not add there files there so it will just be the preinstalled software)
- shared drives on the server. ( //server/software.exe where there is a shortcut in the startmenu pointing to this)

I would like to block .exe running from there mapped drives and any other disks such as USB Floppy and CD Rom

Any advice on where to start looking would be great

Thanks
Lee

[NetworkGeezer]

There are number of ways of doing this. If you are just using vanilla AD then you can use admin templates in the user section of a GPO to run only a permitted "whitelist" of applications.

Also in the computer sectrion of a GPO you can use path rules in Software Restriction Policies to block certain applications or wildcards for network drives or UNCs.

[lee_sri]

i keep seeing the term "Vanilla" could you explain what this is

Thanks
Lee

[ChrisH]

It just means ordinary. In this context not RM or some other other sytem built on top of normal MS server software.

[Norphy]

The easiest way would be to set up a software restriction policy in your group policy as NetworkGeezer suggests. You can quite easily set it up so it only allows executables to be run in (say) the Windows directory, Program Files directory and a folder on a server which is pretty much what we've done.

Downside is, Software Restriction Policies in this context only work with XP Clients. If you want to do this on 2000 its a tad more complicated.

More information here: http://www.microsoft.com/technet/pro.../rstrplcy.mspx

[lee_sri]

That looks an interesting article I’ll take a read

Thanks for the replies