Software restriction policies - Block .exe (from all subfolders)

[maxrebo]

Just setting up SRP to block .exe, .bat etc.., is there a way of blocking these file types to all subfolders other than doing \*\*\*.exe....?

[manick]

Hi Max,

 

Do you mean blocking them from being saved or stopping them being run (as in for cryptolocker purposes)? sorry if this sounds like a daft question just want to make sure what you're asking.

[maxrebo]

Just being run

[manick]

I don't think there is a way and I personally have had to enter the following individually

 

%appdata%*.exe, %appdata%*.bat, %appdata%*.ps1, %Application Data%*.exe, %Application Data%*.bat, %Application Data%*.ps1, %temp%*.exe, %temp%*.bat, %temp%*.ps1, %temp%*.zip*.exe, %temp%\7z\*.exe, %temp%\rar\*.exe, %temp%\wz\*.exe, %userprofile%*.bat, %userprofile%*.exe, %userprofile%*.ps1

 

Hopefully somebody will be along soon who has figured out how to do it.

[Arthur]

is there a way of blocking these file types to all subfolders

If SRP is anything like AppLocker then you can use FOLDERPATH\* to prevent execution from all subfolders. e.g.

 

www.edugeek.net/forums/how-do-you-do/159149-cryptolocker-prevention-4.html#post1440802

[maxrebo]

Ok thanks, I will give this a try this afternoon

[maxrebo]

The above worked fine

[Arthur]

The above worked fine

Excellent! Thanks for the update.