Kids Running VBS files

[tomscaper]

The kids have currently worked out how to create vbs scripts in notepad and are running them. the current one is a message box that pops up and displays the message, you have a virus.

 

I cant seem to figure out how to stop them running.

[Gatt]

You can turn VBScripts off in Group Policy (think its the SRP Policy been that long since i set it up!)

[tomscaper]

I have just looked here

 

http://www.microsoft.com/technet/scriptcenter/guide/sas_sbp_lhak.mspx?mfr=true

 

Does anyone know if this would work, but not disable any logon scripts that we have in place for printers and mapped drives.

[mac_shinobi]

you could create a test OU in ADUC and put one machine in that OU and apply that group policy to that one OU and test to see if applied vb scripts ie applying printers and such like work or not.

 

If not then it is obvious that disabling wsh disables it altogether and if it still works then just to double check ensure that you do gpupdate /force and shutdown and turn it back on, log back on as a students account ( which can be a dummy account in a student OU ) and try it.

[Gatt]

Think i had to add an allow rule to SRP to allow all from the NETLOGON directory..

[tomscaper]

whats srp? also i was thinking of adding a deny permission for the global group the students are in for the file wscript.exe, as i think this allows vbs scripts to run. Edited January 8, 2008 by tomscaper

[fooby]

SRP stands for software restriction policies

 

http://www.google.com/search?hl=en&client=opera&rls=en&hs=Zow&q=software+restriction+policies&btnG=Search

 

this search will show you about it all and help get an understanding of it uses.

 

http://www.windowsnetworking.com/articles_tutorials/Software-Restriction-Policies.html

 

this is good too

 

its been covered a few times in the forums here (I know, I posted in most of them )

[Gatt]

whats srp? also i was thinking of adding a deny permission for the global group the students are in for the file wscript.exe, as i think this allows vbs scripts to run.

 

 

You'll need to allow access wscript.exe, in order to let VSB run - this is the problem i encountered at first.

 

My SRP is set to block VBScripts in the designated File Types section under User Config, then in the actual Rules section allowing wscript.exe to be executed, along with all files that I store in the NETLOGON directory

Edited January 9, 2008 by Gatt
typo's galore!

[Gatt]

Tom, here's a copy of my policy for you to make use of..

Pupil Policy.zip