Software Restrictions not blocking .lnk

[DCUK6]

Have SRP setup and just watched a video on the MSDN site.

 

Ive had SRP setup for students for the past year and whilst watching the video she removed the lnk filter to enable lnk shortcuts to run.

 

Ive checked my SRP out and lnk is still in there but its not actually blocked, i havnt created any addition whitelist rules and the default action is disabled.

 

Any ideas why its not filtered?

[DJ-1701]

Have you got a screenshot of your SRP settings available?

[DCUK6]

Not at the server at the mo,

 

Nothing special in there though. Disallowed has a tick in security level (Default)

 

File types has LNK

 

 

In the enforment bit its set to "All Software files except libraries". Wonder if this is something to do with it. Might change it in our test group.

[6Foot2]

We are using FSRM [Flie Server Resources Manager] to prevent student access to software shortcuts [.LNK files] in their home folders. Is this something you could use too?

 

http://i.snag.gy/ON4tQ.jpg

[DJ-1701]

Very odd, it should be working fine...

 

That being said I just tried it quickly on my PC using gpedit.msc, with those settings most of the shortcuts are blocked for me... but a few still work. Curiouser and curiouser...

[DCUK6]

Thanks Dave.

 

Thats my next thing to do. FSRM to stop the saving of files and SRP to hopefully stop the running. Just need to find a way of setting it for user groups rather than one policy for all.

Edited July 20, 2015 by DCUK6

[psydii]

What are your clients running?

[DCUK6]

Windows 7 pro

[psydii]

Why not AppLocker?

https://technet.microsoft.com/en-us/library/ee619725(v=ws.10).aspx

 

Though Applocker does require patching

 

https://support.microsoft.com/en-us/kb/2894252

[DCUK6]

Applocker isnt supported on 7 Pro. Plan to upgrade to Ent but not this month.

 

Tried enforcing it on all software including dll's but they are still allowed.

 

even tried adding *.lnk into the additional rules list as disallowed to test but they are still allowed.

 

 

 

Update:OK, so tried applying a policy to the computers. Its now blocking all EXE's. Not sure if its blockingg the shortcut or the lnk but the title of the block windows says the exe so may be overriding the user settings.

 

Update2:Seems like setting a computer policy to block lnk stops all lnk files. You then just set in the user policy where lnk files are allowed to run from.

Edited July 24, 2015 by DCUK6