GP to Prevent Running exe not installed

Squan_JRP · August 8, 2014

Wondering if anyone has successfully created a group policy that would prevent students from running any kind of executable, other than those installed on the machine.

Basically, we want to prevent students running .exe from a flash drive or if they are able to download it.

Any thoughts about this?

nickbro · August 8, 2014

Software restriction policies is what you want

Using Software Restriction Policies to Protect Against Unauthorized Software

You can basically set it to stop anyone but administrators running staff that isn't on the c:\* \\domain\netlogon\.* \\domain\sysvol\.*

You can also do hash rules, which in theory will allow unencryption software to run from an external drive but nothing else, never gotten it working properly.

We use SRP to only allow c:\windows\*.*, c:\program files*.* and a few other exceptions (like 100)

Squan_JRP · August 9, 2014

Can you give me an example of some of the other exceptions you have to put in? Also how might this affect Apps in windows 8, if at all?

nickbro · August 9, 2014

Properties

[TABLE=class: subtable]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[/TR]

[TR]

[TD]Allow users to select new root certification authorities (CAs) to trust[/TD]

[TD]Enabled[/TD]

[/TR]

[TR]

[TD]Client computers can trust the following certificate stores[/TD]

[TD]Third-Party Root Certification Authorities and Enterprise Root Certification Authorities[/TD]

[/TR]

[TR]

[TD]To perform certificate-based authentication of users and computers, CAs must meet the following criteria[/TD]

[TD]Registered in Active Directory only[/TD]

[/TR]

[/TABLE]

Software Restriction Policies

[TABLE=class: info]

[TR]

[TD]Enforcement[/TD]

[/TR]

[TR]

[TD] [TABLE=class: subtable3]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[/TR]

[TR]

[TD]Apply software restriction policies to the following[/TD]

[TD]All software files except libraries (such as DLLs)[/TD]

[/TR]

[TR]

[TD]Apply software restriction policies to the following users[/TD]

[TD]All users except local administrators[/TD]

[/TR]

[TR]

[TD]When applying software restriction policies[/TD]

[TD]Ignore certificate rules[/TD]

[/TR]

[/TABLE]

[/TD]

[/TR]

[TR]

[TD]Designated File Types[/TD]

[/TR]

[TR]

[TD] [TABLE=class: subtable]

[TR]

[TH]File Extension[/TH]

[TH]File Type[/TH]

[/TR]

[TR]

[TD]BAS[/TD]

[TD]BAS File[/TD]

[/TR]

[TR]

[TD]BAT[/TD]

[TD]Windows Batch File[/TD]

[/TR]

[TR]

[TD]CHM[/TD]

[TD]Compiled HTML Help file[/TD]

[/TR]

[TR]

[TD]CMD[/TD]

[TD]Windows Command Script[/TD]

[/TR]

[TR]

[TD]COM[/TD]

[TD]MS-DOS Application[/TD]

[/TR]

[TR]

[TD]CPL[/TD]

[TD]Control panel item[/TD]

[/TR]

[TR]

[TD]CRT[/TD]

[TD]Security Certificate[/TD]

[/TR]

[TR]

[TD]EXE[/TD]

[TD]Application[/TD]

[/TR]

[TR]

[TD]HLP[/TD]

[TD]Help file[/TD]

[/TR]

[TR]

[TD]HTA[/TD]

[TD]HTML Application[/TD]

[/TR]

[TR]

[TD]INF[/TD]

[TD]Setup Information[/TD]

[/TR]

[TR]

[TD]INS[/TD]

[TD]INS File[/TD]

[/TR]

[TR]

[TD]ISP[/TD]

[TD]ISP File[/TD]

[/TR]

[TR]

[TD]JS[/TD]

[TD]JScript Script File[/TD]

[/TR]

[TR]

[TD]MSC[/TD]

[TD]Microsoft Common Console Document[/TD]

[/TR]

[TR]

[TD]MSI[/TD]

[TD]Windows Installer Package[/TD]

[/TR]

[TR]

[TD]MSP[/TD]

[TD]Windows Installer Patch[/TD]

[/TR]

[TR]

[TD]MST[/TD]

[TD]MST File[/TD]

[/TR]

[TR]

[TD]OCX[/TD]

[TD]ActiveX control[/TD]

[/TR]

[TR]

[TD]PCD[/TD]

[TD]PCD File[/TD]

[/TR]

[TR]

[TD]PIF[/TD]

[TD]Shortcut to MS-DOS Program[/TD]

[/TR]

[TR]

[TD]REG[/TD]

[TD]Registration Entries[/TD]

[/TR]

[TR]

[TD]SCR[/TD]

[TD]Screen saver[/TD]

[/TR]

[TR]

[TD]SHS[/TD]

[TD]SHS File[/TD]

[/TR]

[TR]

[TD]VB[/TD]

[TD]VB File[/TD]

[/TR]

[TR]

[TD]VBS[/TD]

[TD]VBScript Script File[/TD]

[/TR]

[TR]

[TD]WSC[/TD]

[TD]Windows Script Component[/TD]

[/TR]

[/TABLE]

[/TD]

[/TR]

[TR]

[TD]Trusted Publishers[/TD]

[/TR]

[TR]

[TD] [TABLE=class: subtable]

[TR]

[TD]Trusted publisher management[/TD]

[TD]Allow all administrators and users to manage user's own Trusted Publishers[/TD]

[/TR]

[TR]

[TD]Certificate verification[/TD]

[TD]None[/TD]

[/TR]

[/TABLE]

[/TD]

[/TR]

[/TABLE]

Software Restriction Policies/Security Levels

[TABLE=class: info]

[TR]

[TH]Policy[/TH]

[TH]Setting[/TH]

[/TR]

[TR]

[TD]Default Security Level[/TD]

[TD]Disallowed[/TD]

[/TR]

[/TABLE]

nickbro · August 9, 2014

Software Restriction Policies/Additional Rules

(1.6.1.1);

Security Level Unrestricted

Description USB Key Unlock Software

Date last modified 30/04/2012 14:09:55