Chrome and Firefox can be run without download

[Theldron]

Hi,

 

We have banned the use of Chrome and Firefox in our school due to its ability to allow students to see the C drive and other parts of the network that IE doesnt allow. Friday we had an incident where students have found out that they can run Chrome and Firefox on their system without downloading. I tried it out this morning and it does work, if I click run instead of save Chrome ran and was accessible. Once I had logged off and logged back on it was no longer there.

 

Does anyone know how i can prevent this from happening?

 

Sean

[localzuk]

There's a few options for this:

 

1. Don't block Chrome and Firefox

2. Use a tool such as Impero or Securus to block any window with "Chrome" or "Firefox" in the title

3. Use group policy and FSRM to block exes from running on student drives, desktops and memory stick (combined with USBDLM to control where USB sticks appear)

[jb2201]

I would go for a Software Restriction Policy to restrict any .exe's running from the directory where it is located which is probably a temp downloads folder.

[free780]

Block exe downloads on your proxy. Cut off the source.

[gtg93]

You could block chrome.exe and firefox.exe via GPO... We had a similar thing the other week, and it appears, regardless of what the exe is called, the processes are still chrome.exe and firefox.exe so the block still works.

 

Failing that, Impero or some other monitoring tool as already mentioned.

 

Worth noting, that if you install the chrome gpo extensions, you can lock it down pretty well, allowing it to be used.

[Duke5A]

Had similar issues with students running portable versions of browsers and UltraSurf from their home directories and key chains - App Locker policies put an end to it. Of course you're going to need to be running Windows 7 Enterprise to use this; Professional does not support it.

[Arthur]

We have banned the use of Chrome and Firefox in our school due to its ability to allow students to see the C drive and other parts of the network that IE doesn't allow.

To prevent students browsing all local and network drives in Google Chrome, simply add file://* to the URL blacklist policy (after the ADMX templates have been added to your Group Policy Central Store).

 

Deploying Chrome may make the students less likely to look for alternative browsers.

 

I would also do what others have suggested above and block EXEs on your proxy, through AppLocker and FSRM.

Edited January 31, 2014 by Arthur

[Garacesh]

To prevent students browsing all local and network drives in Google Chrome, simply add file://* to the URL blacklist policy (after the ADMX templates have been added to your Group Policy Central Store)

Wouldn't that screw up the kids making web pages in IT? (I don't know the specifics of the school, but I assume it's secondary if the kids are computer literate enough to download replacement browsers)

 

Realistically there's zero reason kids should be allowed to download .exe's (doesn't RUN still count as a download? I may be wrong..), so disallowing that would be my first port of call in this situation.

Also I'd block the execution of .exe's from their homedrives and temp locations/appdata to ensure they didn't download the exe inside a zip and run it from there, this should also deny 'Run' as it still to my knowledge) downloads it to temp and then executes it.

For good measure, I'd also lock down the C:\ drive with NTFS permissions to ensure nothing can be written there by student accounts (it's possible they may have 'hidden' other programs or such there, if they were downloading things via Chrome)

It goes without saying that exe's from memory sticks ought to be disallowed, too, to stop portable versions brought in from home.

Edited January 31, 2014 by Garacesh

[Theldron]

We use ABTutor in school so I blocked all applications with chrome and Firefox in the name. ABTutor is amazing for the money can't praise it enough.