Prevent EXE downloading.

[T_Lister]

Forgive me if there is a thread already about this, but I have failed to find it;

 

I would like to prevent both staff and pupils from downloading any exe from the internet. I do not however need to block all files. Is there a simple way to do this? We are using Server 2008 R2 and Windows 7 OS. I would like this to apply to both IE11 and Chrome.

 

Thanks in advance.

[6Foot2]

File Server Resource Manager will do this for you.

 

Link: File Server Resource Manager

 

[T_Lister]

Although that will block them from running, we cannot enable this as they require the ability to save and run exe files from projects they work on in class. It is specifically the ability to download, but at the same time still allow them to download things such as PDFs and any other documents/pictures that they might need. This is a policy that we wish to apply to both students and staff.

[3s-gtech]

Do you have any sort of filtering solution?

[T_Lister]

We currently use Surf Protect as our Internet filter.

[Arthur]

Can you block executables on your proxy server?

 

If not, you should be able to block EXEs with the Chrome URL blacklist GPO.

[fairm010]

We currently use Surf Protect as our Internet filter.

 

Contact EXA to see if they can do this on your Stormshield / Netasq.

[T_Lister]

We don't use a proxy server.

[fairm010]

We don't use a proxy server.

 

You do, externally, Surfprotect is your upstream proxy. I use it here.

[6Foot2]

Although that will block them from running, we cannot enable this as they require the ability to save and run exe files from projects they work on in class. It is specifically the ability to download, but at the same time still allow them to download things such as PDFs and any other documents/pictures that they might need. This is a policy that we wish to apply to both students and staff.

 

If they save the EXE files they create in their projects with standardised names [names that have been agreed with you and their tutor: Project1.exe, Thisismyexe.exe,...] you can put exceptions into FSRM to allow these exes only.

[zag]

We use FSRM here to block saving any executables to the user areas. All you need is a windows 2008 R2 server with it enabled. Its quite easy to setup and can even email you when it sees the files.

[stitch]

We use FSRM here to block saving any executables to the user areas. All you need is a windows 2008 R2 server with it enabled. Its quite easy to setup and can even email you when it sees the files.

 

We do this here, but allow our year 11 students to save project executables to a specific folder in their user area and we monitor this folder to make sure there is not unauthorised material in it.

 

We also block students from downloading any executables from the internet or their Google drive for that matter on our firewall.

Edited September 23, 2015 by stitch