+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 16
Windows Thread, Kids saving notepad files as command.bat in Technical; On one of my visits to a year 8 class today the teacher pointed out a little problem that she ...
  1. #1
    Kyle's Avatar
    Join Date
    Jan 2006
    Posts
    983
    Thank Post
    92
    Thanked 14 Times in 13 Posts
    Rep Power
    21

    Kids saving notepad files as command.bat

    On one of my visits to a year 8 class today the teacher pointed out a little problem that she was worried about,

    The kids are opening notepad, typing command.com and then saving the file as a .bat file.

    This worried me a little is there a way this can be stopped? The run command is removed in GP and i am sure that i read R2 can stop these files from being saved.

    Suggestions please?

  2. #2


    Join Date
    Jan 2006
    Posts
    8,202
    Thank Post
    442
    Thanked 1,032 Times in 812 Posts
    Rep Power
    339

    Re: Kids saving notepad files as command.bat

    remove the user read permission from command.com

  3. #3
    ChrisH's Avatar
    Join Date
    Jun 2005
    Location
    East Lancs
    Posts
    4,993
    Thank Post
    120
    Thanked 286 Times in 263 Posts
    Rep Power
    107

    Re: Kids saving notepad files as command.bat

    R2 file screens would stop this kind of nonsense definately. I have re4cently implemented it and it works well.

  4. #4

    Join Date
    Feb 2006
    Posts
    1,187
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Re: Kids saving notepad files as command.bat

    What you should be more worroed about is them being able to excute arbitrary batch scripts. They don't need to bother with command.com why not just use VBS. Get more done.

    Use software restriction policy so that the only executables (exe, cmd or bat) are the ones you yourself have created or deployed.

  5. #5
    Kyle's Avatar
    Join Date
    Jan 2006
    Posts
    983
    Thank Post
    92
    Thanked 14 Times in 13 Posts
    Rep Power
    21

    Re: Kids saving notepad files as command.bat

    Use software restriction policy so that the only executables (exe, cmd or bat) are the ones you yourself have created or deployed.
    How?

  6. #6

    Ric_'s Avatar
    Join Date
    Jun 2005
    Location
    London
    Posts
    7,592
    Thank Post
    109
    Thanked 770 Times in 598 Posts
    Rep Power
    183

    Re: Kids saving notepad files as command.bat

    @Kyle: If you search the forums there's been lots of stuff on software restriction policies. An easier way would be to use File Screening Filters on R2 - there's a pre-defined template for just this!

  7. #7

    plexer's Avatar
    Join Date
    Dec 2005
    Location
    Norfolk
    Posts
    13,578
    Thank Post
    722
    Thanked 1,684 Times in 1,499 Posts
    Rep Power
    432

    Re: Kids saving notepad files as command.bat

    Kyle what os are the clients running?
    Does setting prevent access to command line in gpo not prevent this?

    Ben

  8. #8
    mrforgetful's Avatar
    Join Date
    May 2006
    Posts
    1,639
    Thank Post
    7
    Thanked 15 Times in 15 Posts
    Rep Power
    23

    Re: Kids saving notepad files as command.bat

    Sounds like the Prevent Access to Command line option isn't specified, just that Run is removed from the Start Menu.

    Could be wrong - has been know

  9. #9

    Join Date
    Jul 2006
    Location
    London
    Posts
    2,962
    Thank Post
    160
    Thanked 152 Times in 116 Posts
    Rep Power
    49

    Re: Kids saving notepad files as command.bat

    Quote Originally Posted by mrforgetful
    Sounds like the Prevent Access to Command line option isn't specified, just that Run is removed from the Start Menu.

    Could be wrong - has been know
    Nope, we're having this same problem and we've got that policy enabled

    Does anyone know how to ban all .bat and .exe from a users documents with software restriction policies? Ive blocked command.com and cmd.exe but id like to block all batch files

    Getting R2 sorted near christmas but would like to stop this now

  10. #10


    Join Date
    Jan 2006
    Posts
    8,202
    Thank Post
    442
    Thanked 1,032 Times in 812 Posts
    Rep Power
    339

    Re: Kids saving notepad files as command.bat

    Does anyone know how to ban all .bat and .exe from a users documents with software restriction policies? Ive blocked command.com and cmd.exe but id like to block all batch files
    We do this by whitelisting software that we want to run in Win 2000 GPO - user config - Admin templates - system - run only allowed windows applications. Then combining this with McAfee to ban users saving .exe .bat files.

    Samba can do this natively.

  11. #11

    Join Date
    Jun 2005
    Location
    Leeds
    Posts
    113
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Re: Kids saving notepad files as command.bat

    Quote Originally Posted by sidewinder
    Quote Originally Posted by mrforgetful
    Sounds like the Prevent Access to Command line option isn't specified, just that Run is removed from the Start Menu.

    Could be wrong - has been know
    Nope, we're having this same problem and we've got that policy enabled

    Does anyone know how to ban all .bat and .exe from a users documents with software restriction policies? Ive blocked command.com and cmd.exe but id like to block all batch files

    Getting R2 sorted near christmas but would like to stop this now
    Presumably they can only save these files to their 'home' drives & public file areas?

    In which case add a DENY permission under security (in advanced)for :

    Traverse Folder / Execute

    they then cannot execute any files stored in this location.


    so right-click root of students home drives folder, properties / security / advanced. Add Students group with explicit DENY for Traverse / Execute.

    repeat for any area where they can save files.

    You can also explicitly dney them access to notepad as an executable within AD blocked exe files (forget where exactly),

    the traverse folders / execute one is useful - stops alot of their nefarious type activities.

    Only way round it is for them to find somewhere they can save to, that you havent applied that permission.

  12. #12
    Kyle's Avatar
    Join Date
    Jan 2006
    Posts
    983
    Thank Post
    92
    Thanked 14 Times in 13 Posts
    Rep Power
    21

    Re: Kids saving notepad files as command.bat

    Right, an update today.
    The command prompt and run command are blocked in GPO, and the setting to stop command or bat files is enabled as well, they have even have all vbs log on scripts to keep this working. They have no access to the c:drive at all.

    The kids have a mandatory roaming profile and they are saving this file to their desktops which found weird has they have no access to the c:drive. Roaming profiles are set not o be cached and do clear when they log off. BUT this is what i noticed, when the user logs on it creates a temp profile on the local computer. While they are logged on i checked the security permissions of the temp profile and they have full control, so this is why they can save temporarily to the c: drive in the documents and settings/desktop folder.

    Should this happen? Should the temp profile have full control for the user.

    Please help .....?

  13. #13
    ICTNUT's Avatar
    Join Date
    Jul 2005
    Location
    Hereford
    Posts
    1,419
    Thank Post
    196
    Thanked 249 Times in 122 Posts
    Rep Power
    62

    Re: Kids saving notepad files as command.bat

    @Kyle

    While I do have a mandatory profile mine are not roaming and with a combination of desktop lockdowns via GPO they can NOT save or change anything on the desktop.

    With regard to stopping file types in home directories I currently do not have R2 so the file screening is not an option but for the last 18 months I have been using a server product called SRM SpaceGuard via policies which can be setup for the students is filetype control simply specify the filetypes apply the policy and hey presto no more file saving.

    You can get info from http://www.tools4ever.com/products/spaceguard/ and at a cost of £399 less educational discount (ask for or you won't get it) it was a no brainer for me.

  14. #14
    Kyle's Avatar
    Join Date
    Jan 2006
    Posts
    983
    Thank Post
    92
    Thanked 14 Times in 13 Posts
    Rep Power
    21

    Re: Kids saving notepad files as command.bat

    I do have a mandatory profile mine are not roaming
    How do you set this up?

  15. #15

    john's Avatar
    Join Date
    Sep 2005
    Location
    London
    Posts
    10,399
    Thank Post
    1,516
    Thanked 1,056 Times in 925 Posts
    Rep Power
    303

    Re: Kids saving notepad files as command.bat

    I can only guess that he has the profile stored on the local machine perhaps?? I always thought that mandatory profiles "roamed" as it were IE loading and unloading like a Roaming should do, hence why you can destroy your mandatory but when you log off it ignores your changes and deletes them, but I may be miss-understanding.

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Energy Saving
    By localzuk in forum General Chat
    Replies: 22
    Last Post: 14th June 2010, 09:03 PM
  2. Saving video files from BBC new website pages.
    By tosca925 in forum How do you do....it?
    Replies: 3
    Last Post: 11th June 2007, 11:22 AM
  3. Free script editor other than notepad
    By timbo343 in forum Scripts
    Replies: 19
    Last Post: 8th March 2007, 12:29 PM
  4. How do you stop kids saving tons of jpgs?
    By woody in forum How do you do....it?
    Replies: 8
    Last Post: 6th December 2006, 11:47 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •