Blocking ALL Executables in Students Home Directory

Quote:

---

Originally Posted by DMcCoy

You can switch SRP security level to disable everything, allow specified rather than allow everything disable specified. Needs testing to catch and identify things that should be allowed like login scripts etc.

---

Thats what I do, much easier than trying to block individual areas, not sure why more people done take this route
Only took a few hours of testing to make sure all scripts etc worked. I just allow anything on our apps server and anything in C:\Program Files. That covers 99% of apps we use here

Do you use any disk quota software?

Spaceguard SRM does this job very well but also has an option to deny certain file extensions. We don't allow students to save exe, mp3, or bat files for example.

Since this is independent of policies is won't cause a problem is you want exes or bat files to be used within login scripts (which are run as the currently logged on user).

Quote:

---

Originally Posted by fooby

Yes indeedy.

Software Restriction Policies blocks executing of executables, not any sort of file accessing. We have this set up here, so students can open any of their work files from usb ipod etc but not run any flash games and stuff like that.


If you need more help, it took me ages so i can help with this more.

fooby

---

Do you know if you can get it to block MP3 and the like. Using normal methods does not work for us although everything is is being blocked fine.

How about running a script at log on or log off that deletes them all?

http://217.180.28.46/ictforums/forum...asp?TID=59&KW=

Or, more amusingly, replace them with alternative tracks. I find Aqua - Barbie girl works ok for the lads and the girls seem to hate death metal.

Remember to prepare excuses though. :)

I cant just be deleting peoples MP3 collections off their IPODs and such! I just wanted to stop them playing from a pen drive like I can stop them playing using R2s file screening in their user area.

I eventually got this working for users home directories and USB Drives.

I had to use Fooby's method, which I had to adapt, because a srp does not understand a drive letter mapped to a network share. I had to resort to %HOMESHARE% which blocks all executables in all sub directories in that root drive.

you can use drive letters for USB pen drives, because it is a physical drive. This along with USBDLM deployed and with startup script, worked a treat.

Thanks,
Mark

Thanks for this topic guys never really played with software restrictions and it worked a treat so thanks :)

Ross

Hey all,

I am having problem with software restrictions blocking access databases even tho i had taken access of the MDB extension from designated file types.

Your help is very much appreciated :)

Ross

I had to create an allow rule for *.mdb. It seems to be a known issue.

I made a allow rule but when i open the file with access 2003 it says.

"security warning: unsafe expressions are not blocked.

"Do you want to block unsafe expressions?"

Any ideas?

Ross

Hi Ross, thats to do with the macro security and such as far as I know, if you add the access ADM file to the group policy object you can set it to allow all (low security settings) for macro's and it should be ok.

fooby

Blast from the past...

SRP working perfectly stopping executables running from pen drives and file screening stopping them even being moved to home drives...

Above was mentioned the idea of stopping mp3s from being 'run' from USB Pen Drives - has anybody had any clever(/BOFH) ways of denying this activity?

Quote:

---

Originally Posted by markwilliamson2001

It doesnt seem to block executables on home directories for students areas (which are mapped to H:)

I am going to try %HOMEDRIVE% next to see if it works...

Mark

---

try %homeshare%

:)


You did it already