markwilliamson2001 Posted October 2, 2007 Posted October 2, 2007 Hi! I am trying to block all EXE files in students home directories, using Group Policy Software Restriction Policies, but am struggling at the moment! It is not dependant on a specific application, I just want blanket coverage for all EXE's. It would ideal to block exe's from Pen drives as well. I have looked at USBDLM, but have come up against the software restriction policy again! HELP!! Please... Mark
ICTNUT Posted October 2, 2007 Posted October 2, 2007 You cannot do a blanket block of EXE's using GPO you need to be specific. If you are windoes windows 2003 server R2 it has file restrictions builtin if not you will need to use free tools that you can either sweep the home dirs in a re-active manner or buy some software to control the home dirs in a pro-active manner.
ChrisH Posted October 2, 2007 Posted October 2, 2007 I am using R2s file screening for Home directories and software restriction policies for USB drives. I have found that you can only define scripts and programs though using SRP and not ban stuff like MP3s etc which would have been nice.
markwilliamson2001 Posted October 2, 2007 Author Posted October 2, 2007 How did you do the software restriction policies for the USB drives? This is the nut I currently cannot crack! Ta Mark
Geoff Posted October 2, 2007 Posted October 2, 2007 If you've converted any of your fileservers over to *nix/samba you can use the 'veto files' and 'delete veto files' share level configuration options to block file types based on extension.
leon Posted October 2, 2007 Posted October 2, 2007 Use USBDLM to always map USB drives to the same drive letter(s). Then apply the appropriate software restriction policy to that mapping. What do you mean when you say that you have come up against 'the software restriction policy'?
markwilliamson2001 Posted October 2, 2007 Author Posted October 2, 2007 I understand the software restriction policies upto a point. I have managed to block specific programs (such as media player and windows games) using Path Rules. How, and what type of rule have you used for your USB drives. I thought it would work the same for users home directories, but so far no luck. All our students use H: for their home directories. I tried H:\*.exe and H:\..\*.exe but to no avail!!! Thanks Mark
fooby Posted October 2, 2007 Posted October 2, 2007 You cannot do a blanket block of EXE's using GPO you need to be specific. Dont be silly. See my attachment. You can set different drives as permanantly disallowed. fooby
markwilliamson2001 Posted October 2, 2007 Author Posted October 2, 2007 I still want to allow USB drives, but to block EXE files on them!! Not block them completely!!!!! I don't think anyone actually understands what I am on about so far!! Mark
DMcCoy Posted October 2, 2007 Posted October 2, 2007 You can switch SRP security level to disable everything, allow specified rather than allow everything disable specified. Needs testing to catch and identify things that should be allowed like login scripts etc.
fooby Posted October 2, 2007 Posted October 2, 2007 markwilliamson2001 The settings I have displayed to 100% exactly that. It is what is set here in my college. USB drives and SD XD etc cards read, however no one can execute anything from them. fooby
markwilliamson2001 Posted October 2, 2007 Author Posted October 2, 2007 fooby Does this mean that you can use the pen drive in a normal way, to transfer work (word docs etc etc) and copy to and from the Pen Drive? Ta Mark
fooby Posted October 2, 2007 Posted October 2, 2007 Yes indeedy. Software Restriction Policies blocks executing of executables, not any sort of file accessing. We have this set up here, so students can open any of their work files from usb ipod etc but not run any flash games and stuff like that. If you need more help, it took me ages so i can help with this more. fooby
markwilliamson2001 Posted October 2, 2007 Author Posted October 2, 2007 It doesnt seem to block executables on home directories for students areas (which are mapped to H:) I am going to try %HOMEDRIVE% next to see if it works... Mark
fooby Posted October 2, 2007 Posted October 2, 2007 Sometimes the SRP takes more than one logoff / logon to apply. Try restarting the PC and logon as a student. If not, logoff, logon as admin, start run, gpupdate /force, reboot, logon as student and test, or reboot again and test. group policies can take a while to make sure they are applied. also check the event logs often for errors reported, such as SRP could not apply etc. fooby p.s blocked exe's are also recorded in the event log so u can see if it works.
sidewinder Posted October 2, 2007 Posted October 2, 2007 You can switch SRP security level to disable everything, allow specified rather than allow everything disable specified. Needs testing to catch and identify things that should be allowed like login scripts etc. Thats what I do, much easier than trying to block individual areas, not sure why more people done take this route Only took a few hours of testing to make sure all scripts etc worked. I just allow anything on our apps server and anything in C:\Program Files. That covers 99% of apps we use here
AnnDroyd Posted October 2, 2007 Posted October 2, 2007 Do you use any disk quota software? Spaceguard SRM does this job very well but also has an option to deny certain file extensions. We don't allow students to save exe, mp3, or bat files for example. Since this is independent of policies is won't cause a problem is you want exes or bat files to be used within login scripts (which are run as the currently logged on user).
ChrisH Posted October 2, 2007 Posted October 2, 2007 Yes indeedy. Software Restriction Policies blocks executing of executables, not any sort of file accessing. We have this set up here, so students can open any of their work files from usb ipod etc but not run any flash games and stuff like that. If you need more help, it took me ages so i can help with this more. fooby Do you know if you can get it to block MP3 and the like. Using normal methods does not work for us although everything is is being blocked fine.
AnnDroyd Posted October 2, 2007 Posted October 2, 2007 How about running a script at log on or log off that deletes them all? http://217.180.28.46/ictforums/forum/forum_posts.asp?TID=59&KW=
Geoff Posted October 2, 2007 Posted October 2, 2007 Or, more amusingly, replace them with alternative tracks. I find Aqua - Barbie girl works ok for the lads and the girls seem to hate death metal.
ChrisH Posted October 2, 2007 Posted October 2, 2007 I cant just be deleting peoples MP3 collections off their IPODs and such! I just wanted to stop them playing from a pen drive like I can stop them playing using R2s file screening in their user area.
markwilliamson2001 Posted October 3, 2007 Author Posted October 3, 2007 I eventually got this working for users home directories and USB Drives. I had to use Fooby's method, which I had to adapt, because a srp does not understand a drive letter mapped to a network share. I had to resort to %HOMESHARE% which blocks all executables in all sub directories in that root drive. you can use drive letters for USB pen drives, because it is a physical drive. This along with USBDLM deployed and with startup script, worked a treat. Thanks, Mark
Rozzer Posted October 3, 2007 Posted October 3, 2007 Thanks for this topic guys never really played with software restrictions and it worked a treat so thanks Ross
Rozzer Posted October 8, 2007 Posted October 8, 2007 Hey all, I am having problem with software restrictions blocking access databases even tho i had taken access of the MDB extension from designated file types. Your help is very much appreciated Ross
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now