Chrome Extensions - blocked js files

[midweek]

Hi All

 

Just a bit of advice really. I'm relatively new in post and have been asked to roll out a few Chrome Extensions to users (OneNote Web Clipper and, shortly, Classlink SSO extension).

 

I have the latest admx policies for Chrome and blacklisting everything (*) except the list of Force Installed extensions works fine in testing.

 

However we redirect our roaming appdata to the user's home folder where FSRM heavily blocks what students can actually put in there (exe, js, etc).

The problem is that installing these chrome extensions requires having a bunch of js files downloaded to the AppData folder where, of course, they are blocked so the install fails.

 

I just wondered if anyone had any advice on how other people deal with Chrome Extensions? Presumably lots of schools use them?

 

Obviously I could remove the restriction for .js files in FSRM (or add an exception) but that would have security implications.

 

For reference the file server is 2008 R2 and the clients are Windows 7 x64.

 

I'm probably being daft but I really don't want to have to say to staff "you can't have Chrome Extensions"....!!

 

Thanks

[midweek]

No-one use Chrome extensions?

[Arthur]

Obviously I could remove the restriction for .js files in FSRM (or add an exception) but that would have security implications.

Other than not redirecting AppData I guess your only other option would be to remove the restriction in FSRM, associate .js files with Notepad and block cscript.exe and wscript.exe from accessing the Internet using a Windows Firewall rule.

 

I assume you've already setup AppLocker to block scripts from running?