Blocking 2008 R2 .bat files .cmd

[sbolton]

Hi All,

 

Just looking for a bit of advice please, im trying to set a group policy to stop students writing .bat files etc.

 

When i add in c: to the additional rules it stops them launching .exe files?

 

any ideas please

 

 

Thanks

[Achandler]

We block everything then add exceptions to the correct locations, such as program files etc.

[sbolton]

the problem i have is students create files on the desktop or where ever they can then just rename to .bat,

 

If i have added c: as an exception but then it blocks .exe's from launching from the desktop or Quick launch etc

 

could you please provide me some examples.

[Sheridan]

Software Restriction Policies - default block and then whitelist common paths (c:\program files etc) and make sure they can't browse the C:\ drive to add files into that area.

 

We whitelisted local installed programs and also networked applications which run on a mapped drive (so you only need to whitelist H:\ or similar)

[sbolton]

Software Restriction Policies - default block and then whitelist common paths (c:\program files etc) and make sure they can't browse the C:\ drive to add files into that area.

 

We whitelisted local installed programs and also networked applications which run on a mapped drive (so you only need to whitelist H:\ or similar)

 

Thanks

 

I thought this but unless I add C: to the path then .bat files can still be ran from the desktop?

 

Which then stops .exes etc running?

[Sheridan]

If your default is to block then you only specify where files can be run from, so desktop etc will result in a block. We've found this useful in blocking viruses as well as they tend to try and execute from the users temp folder.

 

Of course it takes a bit of work to take the whitelisting approach but we've found it very effective. You can also use group policy to make the desktop read only so nothing can be created there!

 

It causes the occasional problem with applications that run executables all over the shop but you just have to find what's being run and add it to the SRP whitelist.

 

You will need to work out what needs to be whitelisted (including login scripts!) and then users can literally only run pre approved applications.