Is There any way to stop students dowloading exe files

[krisd32]

I have isa server 2000 and recently found that on a few machines they had installed search bars etc... which were causing problems in ie. is there any possible way i could block the installation or downloading of these files with surf control?

many thanks
kris

[Ste_Harve]

I'd be interested in this. I remember there might have been an option in GP to prevent the download of EXE but it doesn't seem to work.

[Geoff]

I can do this with dansguardian with the mime blocking (although the spyware filterlist grabs lots too).

IIRC ISA can block by mimetype can't it?

[krisd32]

I'm not sure if it can or not i would hope surf control would be able too though!

i've looked in all the obvious places for the settings but to no avail

cheers
kris

[Jake]

We use an executable blocking program, wish I could remember the name of it, but its fairly pricey as I recall

[Jake]

Ah thats right, its called Antiexe

[petectid]

Yep ISA can block download of content by both mime type and extension, you add a content group to a site rule and deny access. I do not know what there now called under the latest version of ISA I believe there are some changes in the naming of objects.

[Alis_Klar]

There are several way to do this.

1. Don't give the user local admin right's to the machine.
   
2. If you absolutely have to give them admin rights you can still stop installation of ActiveX controls in GP. User Configuration-->Windows Setting-->Internet Explorer Maintenance-->Security-->Right Click Security Zones and Ratings. Click Internet Choose Custom Level. Find "Download Signed ActiveX Controls and Choose the disabled Radio button.
   
3. Use a proxy which filters by file extention. For activeX controls you need to block .CAB file extension.

[SYNACK]

You can do this in surfcontrol, there is a category that is called executable files or something similar depending on your version. You just need to add a deny rule for that catagory and it will do what your after.

[webman]

If you have an RM CC3 network, set your students to the Restricted usertype and they won't be able to do this.

[Lithium]

We disabled File Downloads in Internet Explorer outright for the internet zone.

Then just added places like the college website, VLE, Sims Learning Gateway etc as Trusted Websites and allow File Downloads from that zone only - seems to work really well.

[Millsy79]

couldn't you disable windows installer using group policy

[plock]

We disabled File Downloads in Internet Explorer outright for the internet zone.

Then just added places like the college website, VLE, Sims Learning Gateway etc as Trusted Websites and allow File Downloads from that zone only - seems to work really well.

Nice idea too.. I prevent Windows Installer.

http://www.microsoft.com/technet/pro....mspx?mfr=true

[boomam]

We disabled File Downloads in Internet Explorer outright for the internet zone.

Then just added places like the college website, VLE, Sims Learning Gateway etc as Trusted Websites and allow File Downloads from that zone only - seems to work really well.

I tryed that here, caused more problems than it solved tbh.
I just have file restrictions on their areas, and run restrictions on their USB sticks.

[Lithium]

I tryed that here, caused more problems than it solved tbh.
I just have file restrictions on their areas, and run restrictions on their USB sticks.

Got that too... and Windows Installer disabled

We've not had any problems with it though, we did do it slowly over time.

The only major thing with it is traversing between trusted and non-trusted sites always asks if you want to proceed or not, but its nothing too drastic.