File restrictions issues?!

[mike86]

I've set up a file restrictions policy to stop .exe files running from pen drives, but it has come to my attention that if you run them from a compressed folder in explorer view then they will open succesfully? Does anyone know a group policy setting that will stop this, and force them to extract the compressed folder? Or can you think of another way of stopping this?

 

Google is only showing reg edits to enable this.

 

thanks

[DJ-1701]

I've set up a file restrictions policy to stop .exe files running from pen drives, but it has come to my attention that if you run them from a compressed folder in explorer view then they will open succesfully? Does anyone know a group policy setting that will stop this, and force them to extract the compressed folder? Or can you think of another way of stopping this?

 

Google is only showing reg edits to enable this.

 

thanks

 

When running an EXE from a Zip file it first extracts to a temporary location and then runs. I think it's placed in the %temp% folder variable, but if you run Process Monitor (https://technet.microsoft.com/en-us/sysinternals/bb896645), it should show where it has run from in the log.

[mike86]

When running an EXE from a Zip file it first extracts to a temporary location and then runs. I think it's placed in the %temp% folder variable, but if you run Process Monitor (https://technet.microsoft.com/en-us/sysinternals/bb896645), it should show where it has run from in the log.

 

Thanks, will give this a shot.

[Arthur]

Or can you think of another way of stopping this?

I use AppLocker rather than SRP, but the following rule should block all EXEs from executing from your temp folder (inc. subfolders).

 

%OSDRIVE%\Users\*\AppData\Local\Temp\*

[mike86]

I use AppLocker rather than SRP, but the following rule should block all EXEs from executing from your temp folder (inc. subfolders).

 

%OSDRIVE%\Users\*\AppData\Local\Temp\*

 

This did not work. Had to use %LocalAppData%\Temp\*.zip\*

 

All sorted now. Thanks

[Arthur]

This did not work.

The OSDrive variable must be AppLocker only in that case.

 

Had to use %LocalAppData%\Temp\*.zip\*

Did you try %LocalAppData%\Temp\*?

 

You will probably find that students start using .cab, .7z and .rar files to get around your block if you only do .zip files.

Edited February 8, 2017 by Arthur