Windows 10 Education - Disable Run Command GPO

[atechguy]

Hello,

 

I've been doing some testing on a Windows 10 Education build. After imaging and locking down users via Group Policy i have noticed a security issue when logged on as a standard user. I cannot stop standard users being able to UNC from either the search bar or Windows Explorer to any DFS path. For example \\domain.local\sysvol - Standard users have full access to these files.

 

Has anyone come across this and what did you do to stop it?

 

I am stumped.

 

Thank you

 

 

EDIT - I have managed to disallow unc searching from the Windows File Explorer search/navigation bar but i cannot stop the windows 10 search bar or just when you hit the windows key and start typing from accessing UNC\DFS paths

Edited May 23, 2016 by atechguy

[Arcath]

I have the same problem, posted it over on super user to no avail Stop Windows 10 search from running commands - Super User

[Homer]

It's a pain but if file permissions are set correctly is it going to pose much of a security issue?

[Arcath]

@Homer,

 

I think so.

 

I have shared content that is accessed through \\domain.local\software\content\title which they have read/write access to so they can write shared resources and update databases etc... which is safe from deletion as they can't browse to it in explorer or open cmd to run a del command but with this the start menu would open it for them.

[Arthur]

I am stumped.

The "Remove Run menu from Start Menu" policy no longer works in Windows 10 according to Microsoft.

 

https://technet.microsoft.com/en-us/itpro/windows/manage/changes-to-start-policies-in-windows-10

 

Edited May 24, 2016 by Arthur

[FragglePete]

I've managed to disable it in Windows 10 - it's still on the Menu but if you click it (or hit Windows+R) you get the following restriction message:

 

 

Now, your gonna ask me how I did that aren't you..... erm...... not too sure at the moment so I'll take a look through my Policies, but it is possible.

 

Pete

[beany1]

Ok I'm going to ask a serious but probably stupid question! If UAC is enabled and your file shares have correct permissions...what could a user do from the run dialog that is untoward?

[Arthur]

what could a user do from the run dialog that is untoward?

Search through AD?

 

rundll32 dsquery,OpenQueryWindow

[Mustang]

Even if you do disable the run box, there is nothing stopping the user creating a shortcut to the share

[beany1]

To add to this though - I've had run disabled through group policy from Windows 7 - which still works on Win 8.1 and now on Windows 10...

 

Soon as I disabled the "Remove Run menu from the Start Menu" I could access run - if I enable that policy I can't access run from the WinX menu, or use WIN+R. You just get the same error that @FragglePete showed in the screenie.

 

I'm still unsure what real damage could be done however? Accessing the AD search doesn't do much they can't even see usernames...

Edited May 25, 2016 by beany1

[Homer]

If you expand the search by choosing additional columns you can, and it would expose any service accounts etc you have.

 

tbf I didn't read this thread properly before and neglected to see that this is about the run box for some reason I thought it was just browsing file shares. I wouldn't want my lot having access to run either, just gives them another vector to do something untoward (that we, don't know of yet)

[kennysarmy]

Maximum size of Active Directory searches

 

Set to zero helps.

 

https://msdn.microsoft.com/en-gb/library/ms813302.aspx?f=255&MSPPError=-2147217396

[atechguy]

Its not so much the run command box thats the issue, its typing unc paths directly into the search box and allowing user access to netlogon and sysvol via dfs paths

[atechguy]

Maximum size of Active Directory searches

 

Set to zero helps.

 

https://msdn.microsoft.com/en-gb/library/ms813302.aspx?f=255&MSPPError=-2147217396

 

Thanks for this, will give it a try

[Mustang]

Thanks for this, will give it a try

 

If you set this, users will not be able to search the directory when they want to manually add a printer. To add a printer they will need to know the print server name and printer share name

[kennysarmy]

If you set this, users will not be able to search the directory when they want to manually add a printer. To add a printer they will need to know the print server name and printer share name

 

Personally I don't allow students to add printers - so it's not a problem for us, we choose which devices they should be allowed to print to!

[KibosJ]

We have CMD disabled but a student can still search for and open Powershell.

 

This is stupid, there should be a way to just disable this :/

[Jawloms]

We have CMD disabled but a student can still search for and open Powershell.

 

This is stupid, there should be a way to just disable this :/

 

There is; you add powershell.exe and powershell_ise.exe to the "Don't run specified Windows Applications" GPO.

[KibosJ]

There is; you add powershell.exe and powershell_ise.exe to the "Don't run specified Windows Applications" GPO.

 

I can do that, but the point is students couldn't do any of this in Windows 7 but now can in Windows 10, why can't I just disable search?

[KibosJ]

Never mind, I've sorted it students cannot search for anything now.

[atechguy]

If you set this, users will not be able to search the directory when they want to manually add a printer. To add a printer they will need to know the print server name and printer share name

 

No problem there as printers are applied via GPP

[JoeCav]

KibosJ, don't suppose you can share your method for blocking search could you? sorry for bumping an old post but looking everywhere for this.

[KibosJ]

KibosJ, don't suppose you can share your method for blocking search could you? sorry for bumping an old post but looking everywhere for this.

 

Hi, I've use AppLocker to block Cortana.

 

Package Name: Microsoft.Windows.Cortana

[JoeCav]

Hi, I've use AppLocker to block Cortana.

 

Package Name: Microsoft.Windows.Cortana

 

I've done a Packaged app Rules policy to Deny Everyone package name "Microsoft.Windows.Cortana", done a gpupdate and reboot and I'm still able to type "gpupdate" in search and it show up as run command, would you be able to share a screenshot of your policy?Thanks for your help and quick reply

[KibosJ]

I've done a Packaged app Rules policy to Deny Everyone package name "Microsoft.Windows.Cortana", done a gpupdate and reboot and I'm still able to type "gpupdate" in search and it show up as run command, would you be able to share a screenshot of your policy?Thanks for your help and quick reply

 

Hi

 

I've attached images of how the policy is set here.