Strange thing with GPO settings not taking affect.

I was watching a couple of kids today through VNC and i noticed that they were downloading Google earth and installing it themselves.?????????

I would not have believed it if i had not seen it myself. In the GPO they cannot see the C: drive nnd have not access to it butt hey had no problem installing Google Earth. I have checked all the GPO settings and they are all as i thought. We run ISA 2000 and that stopped most forms of downloading possible or so i thought........! I know ISA is working ok because staff complain they cannot download certain things when they are on the network.

Surely there is nothing special with Google Earth.

I've cracked the no download thing - now i'm being forced to remove it because kids can't download pdf's etc.

IE is a major pain - the download cache is independant and can be instaled from - that would be my first port of call.

How did you crack it?

Simple. You enable the GPO which prevents users from installing software.

%GPO%\Local computer policy\administrative templates\windows installer\prohibit user installs.

You can also prevent users from downloading .exe files by GPO but I can't find it at the moment.

there are a couple of GP settings to prevent downloads, as well as denying installs.

Also in that group Dos_Box: disable windows installer

plus:

User Policy\administrative templates\windows components\Internet Explorer\security settings\restrict file downloads

[there's a matching policy on the local computer policy side]

If you restrict Windows installer then programs like Office cannot do user configs.

@dos__Box

Quote:

---

%GPO%\Local computer policy\administrative templates\windows installer\prohibit user installs.

---

I take it this setting does not affect .msi install througth GPO?

Quote:

---

You can also prevent users from downloading .exe files by GPO but I can't find it at the moment.

---

I've looked as well and i can't find it either. Let me know if you do.

@mark

Quote:

---

User Policy\administrative templates\windows components\Internet Explorer\security settings\restrict file downloads

---

I've just had a look at this. Is it not just dissableing the prompt box or does it actually stop any type of download?

You could always try blocking certain applications running via GPO. By default put in *.msi, winmine.exe, sol.exe, setup.exe and so on ... this really annoys the kids because they can see the games there ... but can't play them. And it also helps to try and stop them when they are trying to install apps too.

Evil? Me? Why thank you kind sirs ;-)

Quote:

---

Originally Posted by tosca925

@mark

Quote:

---

User Policy\administrative templates\windows components\Internet Explorer\security settings\restrict file downloads

---

I've just had a look at this. Is it not just dissableing the prompt box or does it actually stop any type of download?

---

If you look in the settings of that policy, you have 2 options: prevent user initiated and prevent non initiated.

We are having the same problem, especially with google earth as we do not want the school using it due to its data harvesting properties. Our MIS systems is Facility CMIS and we use the eportal for everything now, its as rare as hens teeth to find the full program on any machine, but we dont want Google reading or doing anything with any temps or files left behind with the eportal. Kids are downloading it willy nilly and as a result its installing on there roaming profiles so its slowing down logons grrrr. We have checked the GPO's mentioned and still they can do it, but yet there are other sites out there that have similar install setups and they cannot do it with them! Have Google got some special "bypass GPO's to make sure everyone can and does use our product" skills? Its annoying and going to cause us problems soon......

Roaming profiles are evil. Bin them.

As a mod, should i remove roaming profile bashing (after seeing it on many threads)?? :P :P

Regarding the preventing download in IE GP setting, i forget what it is, but it stops you clicking save on the requester - well, you can click it but you then get a message saying "not allows blah blah - or whatever it is lol"

I'll try to remembr to dig it out tomorrow :)

They, of course, can click Open but for some reason - i must have got the right settings down or something, I havent noticed any games appearing anywhere :D

With pdf's etc, just click open mark lmao :P

Regards
Nath