Block Java Games

[itgeek]

Hi

 

 

How are people blocking java games and .exe on the network. I have added the title to blocked apps but the students change the name of the file.

 

 

Thanks in advance

[jb2201]

I would use Software Restriction Policies to prevent all .jar and .exe files running from any shares were students can openly share files.

[free780]

Depending on how brave you are. You can implement Java Deployment Rulesets.

 

Deployment Rule Set

[itgeek]

Thanks jb2201 How would I go about doing this doing this please?

 

Thanks

[jb2201]

Its group policy based so add a new group policy (or add to an existing), I would create a new GPO so you can limit the scope down to individual accounts (you can really cause some damage if you mess up Software Restriction Policies).

 

When you have a new policy open, go to User Configuration -> Windows Settings -> Security Settings and right click on Software Restriction Policies and click New.

 

This will create you a little folder structure, security level is the default security level, I would set this to disallowed, which will mean any file types which are flagged will get blocked. However this means for example that ALL .jar files and ALL .exe files would get blocked, therefore you need to go into the additional rules folder and add some paths which are unrestricted to allow users to run restricted file types from these areas.

 

Microsoft adds a few in for you already (stuff like the program files folders), as well as that I have added in rules for the netlogon folder, sysvol and our central application share. To add a path rule just right click and select 'New Path Rule...'.

 

Its a pretty straight forward process for adding new rules, with the default security level set to disallow all you really need to do is create some unrestricted paths for anywhere were you want students to be able to run the restricted file types, as I said earlier, Windows covers the basic local ones for you so you just need to add some in for the application shares on your network.

 

You can use a ? in a path string to indicate a wild card character (for example svr-ad? to catch multiple AD's on a path rule).

 

One last thing as well, I am not sure if java files are added as a designated file type by default, if not you can add / remove file types affected by the SRP's by clicking on the Software Restriction Policies folder then clicking on Designated File Types. From here its pretty straight forward, just add the file extensions in at the bottom.

 

SRP's always take a bit of tinkering to get them to work properly, if you need anymore help just let me know.