augustm Posted November 28, 2007 Posted November 28, 2007 Hello Geeksters!....I have a problem at my school. I uninstalled MSN messenger and all games from our systems, but these kids are reinstalling some hacked version of messenger that bypasses all secrity settings. Is there a way to stop any .exe fron beling launched from default home drives or usb sticks?
maniac Posted November 29, 2007 Posted November 29, 2007 If you have 2003 R2, you can apply rules to the home folders to stop EXEs being stored there in the first place, and it e-mails you every time someone tries to save one, works a treat! As for USB sticks, I believe you can use a section of active diectory to control the areas they are allowed to launch programs from. Use the USB drive letter manager software to control what drive letter is used for your USB sticks, and disallow that drive for execution of programs.
ChrisH Posted November 29, 2007 Posted November 29, 2007 This topic has been covered extensively before if you do a search. Like maniac says the File screen features of R2 are great for home folders and for USB drives use the program USBDLM combined with software restriction policies will sort them out.
timbo343 Posted November 29, 2007 Posted November 29, 2007 Hello Geeksters!....I have a problem at my school. I uninstalled MSN messenger and all games from our systems, but these kids are reinstalling some hacked version of messenger that bypasses all secrity settings. Is there a way to stop any .exe fron beling launched from default home drives or usb sticks? We set this is software restrictions in GP and works great. Just add in d: e: f: g: and thier home drive. Will work a treat. Also, you may want to block the local temp folders as running exe's can add files to there.
ajbritton Posted November 29, 2007 Posted November 29, 2007 We set this is software restrictions in GP and works great. Just add in d: e: f: g: and thier home drive. Will work a treat. Also, you may want to block the local temp folders as running exe's can add files to there. Rather than trying to block particular locations, it can be easier and more secure to just allow the locations you want executables to be launched from (eg C:\Program Files, C:\Windows)
dan400007 Posted November 29, 2007 Posted November 29, 2007 If its JUST the home folder you want to stop it happening in then you can also set special permissions on their folders to stop them running programs.
ajbritton Posted November 29, 2007 Posted November 29, 2007 If its JUST the home folder you want to stop it happening in then you can also set special permissions on their folders to stop them running programs. If you are talking about removing the 'execute' NTFS permissions then I don't think it will work. If a student is able to copy a file into their home folder then as the creator of the file, then implicitly have the permission to change the permissions on it. That means that although the file may inherit a set of permissions that does not include the execute permissions, the student cannot be prevented (other than by hiding the interfaces) from changing the permissions on that file.
dan400007 Posted November 29, 2007 Posted November 29, 2007 True. We have 'right-click' and the command prompt disabled for all students. This gets around the problem for all but the smarter students and at that point they're smart enough to realise that they can and will be caught in the end. As another thread says, how far do you take security. No something to start in this thread. We're not currently using the file screening in R2 as we've just moved our user areas over to an R2 server. But does R2 screening look within compressed files? For example if a student has an exe in a zipped file would they be able to run that file or would R2 pick it up?
sidewinder Posted November 30, 2007 Posted November 30, 2007 We're not currently using the file screening in R2 as we've just moved our user areas over to an R2 server. But does R2 screening look within compressed files? For example if a student has an exe in a zipped file would they be able to run that file or would R2 pick it up? Unsure. I just block zipped files as well
greenfieldsupport Posted November 30, 2007 Posted November 30, 2007 Yes we needed to block zips aswell as it runs it from the temp directory... c:\windows\temp
cookie_monster Posted November 30, 2007 Posted November 30, 2007 If the zip extracts to temp then it will get around file screening this is where software restriction comes in.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now