Block vbs cmd but allow login scripts etc

[itgeek]

Hi

 

How are you blocking .vbs .cmd .bat files but still allowing login scripts to run and scripts for printers etc?

 

I was thinking software restrictions but have never done that before any guidance if possible

 

Thanks in advance

[ChrisH]

You would have software restrictions on user and shared areas etc. Use some kind of tool like USBDLM to make sure the USB drives are the same letters on all machines and apply the restrictions to them as well.

[Steve21]

Add an allow for

\\DOMAIN.internal\SysVol\DOMAIN.internal\Policies\*

and a generic deny etc

 

Steve

[itgeek]

Thanks for the answers. Would it be possible just to block the file types not all software?

 

Thanks again

[Steve21]

\\mypath\*.vbs

etc

 

Steve

[itgeek]

I am correct in thinking that you cant just disable one file type but you have to add all the software first then disallow the vbs cmd etc?

 

I just want to put block vbs cmd bat is that possible?

 

Thanks

[3s-gtech]

No, software restriction policies can disallow one file type, as long as you specify from where. We have this set for home areas, certain shares, Appdata and memory sticks. Also works to give some protection from malware.

[MordyT]

To give a better answer, no need for login scripts... GPO everything!