Blocking exe files

[denners31]

Hello all.

 

At our school, we have the running of exe files blocked from running from memory sticks and we also do not allow students to install software. However, clever as these kids are, they have found out that any self contained exe games that just run a game when double clicked and not install, will run perfectly fine if copied to the desktop. We have super mandatory profiles here and any changes they do to the desktop are only temporary. I have managed using software restriction policies to stop the running of exe files from the desktop. I have also managed to stop them from running exe's with a one level folder. However, if the folder is in the next level down, it will run the exe and I can't seem to stop that. this is what I have set to disallowed.

 

C:\users\%username%\destop\*.exe (blocks exe files directly ran from the desktop) - Works fine

C:\users\%username%\desktop\*\*.exe (blocks anything within a folder at the first level from running e.g C:\users\bloggsj\desktop\myfolder\myexe.exe) - Works fine

 

However anything in a folder at the next level down is not blocked e.g C:\users\bloggsj\desktop\myfolder\myfolder1\myexe.exe - exe runs

 

Because we don't know what the folder or exe will or can be called, I would like to know if there is a variable that basically looks at C:\users\%username%\desktop\ and will check any paths after this and stop exe.

 

Thanks in advance

 

David

[Steve21]

Looking at this the other way, is there any reason you aren't blocking all exe's than just allowing what you wnat to run?

 

Steve

[denners31]

That is actually a fair point. On their desktops, there are actually no exe files, just shortcuts. I just thought because we don't know the names of the exe's, we could just block any exe's that run after a specific path. If they are clever enough, then surely they could just rename one of their game exe's to a known working exe such as winword.exe and it would run because winword.exe is allowed? they don't have access to the C:\ drive direct, only the desktop and that is where they are getting away with running these exe's. So in theory if I could block anything after the desktop folder within their profile, this would stop the exe files.

 

David

[Steve21]

The way most seem to do this is just do a flat block, nowhere can run exes.

 

Then unrestrict areas they want to let you run it from, e.g. C:\Windows C:\ProgramFiles etc etc.

 

Then nothing would run outside of this, and if you want an area to run e.g. X:\ drive you just add that as an allowed list.

 

Then no CDs/USBs etc etc would work, no matter what they try to do

 

Steve

[Duke5A]

The way most seem to do this is just do a flat block, nowhere can run exes.

 

Then unrestrict areas they want to let you run it from, e.g. C:\Windows C:\ProgramFiles etc etc.

 

Then nothing would run outside of this, and if you want an area to run e.g. X:\ drive you just add that as an allowed list.

 

Then no CDs/USBs etc etc would work, no matter what they try to do

 

Steve

 

This is exactly what we're doing too. Using App Locker it has been extremely successful.