+ Post New Thread
Results 1 to 11 of 11
Windows Thread, problem with software access policy in Technical; We have setup software access policys so that they disallow .exe being run from D:,E:,F:, and from desktops. We have ...
  1. #1

    Join Date
    Feb 2007
    Location
    Hereford
    Posts
    213
    Thank Post
    5
    Thanked 3 Times in 3 Posts
    Rep Power
    16

    problem with software access policy

    We have setup software access policys so that they disallow .exe being run from D:,E:,F:, and from desktops.

    We have allowed unrestricted access to the shared area.

    This all works fine. The Z:\ which is mapped to the user home dir doesn't work.

    I 've set Z: so that it is disallowed, I can still run exe file from this drive.

    All other drives are mapped with login scripts.

    what going wrong?????

  2. #2
    ajbritton's Avatar
    Join Date
    Jul 2005
    Location
    Wandsworth
    Posts
    1,632
    Thank Post
    23
    Thanked 75 Times in 45 Posts
    Rep Power
    34

    Re: problem with software access policy

    I think the best way to do software restriction is on a 'white list' basis. Rather than trying to deny execution from certain paths, do a flat 'deny' from everywhere and then open up specific paths (eg C:\Program Files, C:\Windows etc).

  3. #3
    Norphy's Avatar
    Join Date
    Jan 2006
    Location
    Harpenden
    Posts
    2,227
    Thank Post
    50
    Thanked 271 Times in 209 Posts
    Blog Entries
    6
    Rep Power
    108

    Re: problem with software access policy

    If you really must blacklist, blacklist the UNC of the shared drive rather than the drive letter.

    But ajbritton is right, it is much more logical to block everything and allow a specific set of programs through.

  4. #4

    Gatt's Avatar
    Join Date
    Jan 2006
    Posts
    6,644
    Thank Post
    858
    Thanked 645 Times in 428 Posts
    Rep Power
    498

    Re: problem with software access policy

    Agreed, set your SRP to DISALLOWED by default, then open up the programs you want via either PATH or HASH rules.

    Hash rules are a better choice, as it prevents kids from renaming the files to an allowed filename so they can run them.

  5. #5

    Join Date
    Feb 2007
    Location
    Hereford
    Posts
    213
    Thank Post
    5
    Thanked 3 Times in 3 Posts
    Rep Power
    16

    Re: problem with software access policy

    We have it now to block all.
    I'm then adding in paths rules to allow the shared area and the multimedia drive.

    When i login as test the software policy is stopping the login script setup the P: and Y: drives.

    The rules i set for these 2 drives are using drive letters. Should i be using the unc path to the shared folder?

  6. #6
    Norphy's Avatar
    Join Date
    Jan 2006
    Location
    Harpenden
    Posts
    2,227
    Thank Post
    50
    Thanked 271 Times in 209 Posts
    Blog Entries
    6
    Rep Power
    108

    Re: problem with software access policy

    Yes

  7. #7
    tarquel's Avatar
    Join Date
    Jun 2005
    Location
    Powys, Mid-Wales, UK
    Posts
    1,740
    Thank Post
    13
    Thanked 44 Times in 34 Posts
    Rep Power
    29

    Re: problem with software access policy

    Just a thought here but i believe drive Z is used in the system for something when it comes to batch / command scripts etc....

    Sorry i cant be that clear, but all I can remember is that I was trying to do something using drive Z and when I used a different drive letter, it worked.

    Maybe this is why you had:

    've set Z: so that it is disallowed, I can still run exe file from this drive.
    Nath.

  8. #8
    ChrisH's Avatar
    Join Date
    Jun 2005
    Location
    East Lancs
    Posts
    4,996
    Thank Post
    120
    Thanked 280 Times in 258 Posts
    Rep Power
    106

    Re: problem with software access policy

    We have z: as our home drives wiht no problems.

  9. #9
    tarquel's Avatar
    Join Date
    Jun 2005
    Location
    Powys, Mid-Wales, UK
    Posts
    1,740
    Thank Post
    13
    Thanked 44 Times in 34 Posts
    Rep Power
    29

    Re: problem with software access policy

    Odd...

    well whatever it was, I remember we discussed it on here lol

    Nath.

  10. #10

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: problem with software access policy

    I set removable drives to start at Z: and go backwards, perhaps that's what you were thinking of tarquel?

  11. #11

    Join Date
    Feb 2007
    Location
    Hereford
    Posts
    213
    Thank Post
    5
    Thanked 3 Times in 3 Posts
    Rep Power
    16

    Re: problem with software access policy

    thanks guys for your help.
    I've just got it to work.

    I'm not using disallow all.
    To get the home shares drive Z; to work i had to add
    Z:\%username% disallow

SHARE:
+ Post New Thread

Similar Threads

  1. CC3 Software Restriction Policy
    By cookie_monster in forum Network and Classroom Management
    Replies: 8
    Last Post: 12th June 2007, 10:28 AM
  2. Policy problem
    By localzuk in forum Windows
    Replies: 14
    Last Post: 16th February 2007, 07:14 PM
  3. Cannot Access group policy objects
    By timbo343 in forum Windows
    Replies: 35
    Last Post: 13th October 2006, 02:23 PM
  4. GPo - Software Restriction Policy
    By Gatt in forum Wireless Networks
    Replies: 26
    Last Post: 23rd January 2006, 01:53 PM
  5. What is your school policy for pupils who access porn?
    By woody in forum School ICT Policies
    Replies: 24
    Last Post: 8th November 2005, 10:47 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •