Group policy

[ricki]

Hi

 

I have a little problem and I have got stuck. Please can you help.

 

I want to stop kids running things from there my (documents) H: and from the e: drive where usbs are mounted.

 

The file extensions I am trying to stop running are.

 

.bat

.exe

.vbs

etc

 

I have created a path rule in gpo and linked it to the correct ou things like

 

h:\*.bat

h:\*.exe

 

and this works great except it only blocks things in the root of the area.

 

Has anyone got any ideas how I can block any files with these extensions in other folders on the drives.

 

Thanks for all your help.

 

Richard

[flyinghaggis]

You just need to add the file extension you want to block into the 'designated files types' list. Then you can add a disallow path rule for 'H:\' and it'll automatically block everything on the file types list from running on that entire drive Edited February 26, 2008 by flyinghaggis

[Steven]

Hi, How do you Add a mapped network drive so its the users "My Documents" as a home folder via GPO many thanks steve.

[Gatt]

Hi, How do you Add a mapped network drive so its the users "My Documents" as a home folder via GPO many thanks steve.

 

You cant with Win2k3, but you can with Win2k8 - when the necessary Client Side Extension is released for WinXP.. It's supposed to be in-built with Vista SP1 but not tried it yet...

 

You need to use a batch file or, as we do here a KixTart script that maps the relevent drives, then also calls a VBScript file to rename them from "share on 'server'"

 

You can, however, redirect their My Doc's folder to their home drive using Folder Redirection....

[ricki]

I add the drives through a mapping script at log on. I dont what to block everything from the h: drive as this would stop them getting at personal documents . I just what them not to be able to bring in exes, etc on usb drives and copying them to my documents. Then being able to run exes, etc on usbs and those in my documents.

 

Richard

[MkII]

You define the executables you want blocking Richard in the computer settings of software restriction policies - it doesn't block 'everything' - only the files with extensions that you specify