Zoom7000 Posted March 12, 2008 Posted March 12, 2008 These are fast becoming a huge nightmare! I'm trying as much as I can to grab them off student USB flash drives and apply hash blocks in Active Directory and apply block policies using AB Tutor. However, there are newer versions coming out all the time. Also, some stuff you can't apply AB Tutor policies to. E.g. Microsoft Office Word 2007 in the title bar just appears as Microsoft Word. Can't block that because we want them to run Word, just not off their pen drive! Other interesting stuff I found was: UltraSurf - Gets the current proxy address settings on the PC. Tries to bypass WLM Lite - Portable Windows Live Messenger. Deskspace - Really cool application that allows you to have 4 independant desktops. You can switch desktops by a custom key press in a cube like effect and the open windows from the other desktops disappear until you activate them again. Actually really cool! lol Then the usual suspects - Portable Kaspersky, Portable Adobe CS3, Portable Nero, Portable LimeWire, Portable utorrent, the list goes on! I even found a portable version of AB Tutor. I've emailed that off to Andy at AB Consulting for further investigation. I have USBDLM assigning Flash Drives as K: L: and M: repectively, can I block all .exe, .bat .cmd .vbs etc running at all from flash drives?
powdarrmonkey Posted March 12, 2008 Posted March 12, 2008 Yes, with path rules. Details have been posted before.
Guest Guest Posted March 12, 2008 Posted March 12, 2008 I have USBDLM assigning Flash Drives as K: L: and M: repectively, can I block all .exe, .bat .cmd .vbs etc running at all from flash drives? Yes, do a search its been covered many a time
KarlGoddard Posted March 12, 2008 Posted March 12, 2008 Software restriction policies are your friend! We started using them around 18 months ago and noticed the difference almost immediately. We had one or two minor problems with the odd 'legit' app that got blocked but a quick tweak here and there and it worked like a dream ever since http://technet.microsoft.com/en-us/library/bb457006.aspx http://support.microsoft.com/kb/324036 HTH
projector1 Posted March 12, 2008 Posted March 12, 2008 is it my machine or is the "thanks" link missing from this thread?
dhicks Posted March 12, 2008 Posted March 12, 2008 WLM Lite - Portable Windows Live Messenger I've bet one of our prep school pupils she can't get this working in the prep school IT room. She seemed quite enthusiastic about the challenge. I don't think she quite appreciates that our prep IT room runs Edubuntu-based thin clients, but I figure she will by the time she's finished... -- David Hicks
Zoom7000 Posted March 12, 2008 Author Posted March 12, 2008 I've had a search and found the technique of using software restriction, in my case... K:\*.exe K:\*\*.exe K:\*\*\*.exe However, the K:*.exe won't work, so I have to keep doing the \*\*\*.exe technique, but this is not fool proof. Is there a way to block it on all subfolders too?
TechMonkey Posted March 12, 2008 Posted March 12, 2008 I've had a search and found the technique of using software restriction, in my case... K:\*.exe K:\*\*.exe K:\*\*\*.exe However, the K:*.exe won't work, so I have to keep doing the \*\*\*.exe technique, but this is not fool proof. Is there a way to block it on all subfolders too? Can you not just ban K:\* ?
MarkB Posted March 12, 2008 Posted March 12, 2008 We block everything by default and only allow programs to run from known locations (Program Files, windows folder, etc).
ajbritton Posted March 12, 2008 Posted March 12, 2008 Agree with Mark B. Best bet is to start with a blanket ban on everything and just allow what you need. On the basis that PCs are locked down, it is safe to allow execution from Windows and Program Files. If necessary add rules to allow execution from network locations.
FN-GM Posted March 12, 2008 Posted March 12, 2008 (edited) We don't tend to have this problem, we get alot of flash games in excel files. Edited March 13, 2008 by Ric_ snip!
KarlGoddard Posted March 13, 2008 Posted March 13, 2008 (edited) We don't tend to have this problem, we get alot of flash games in excel files. use strings.exe from sysinternals to search within *.xls for '.swf' this finds any embedded swf's quite nicely! Edited March 13, 2008 by KarlGoddard spelling 1
Zoom7000 Posted June 26, 2009 Author Posted June 26, 2009 We block everything by default and only allow programs to run from known locations (Program Files, windows folder, etc). Sorry to bring this thread back from the depths of thread doom, however, I was trying this method of blocking *.exe files with the default settings of Program Files, SystemDrive, SystemRoot etc being unrestricted. But, disabling *.exe seems to overide the unrestricted settings. So, is there any simple way of blocking .exe files from anywhere other than those locations?
User3204 Posted June 26, 2009 Posted June 26, 2009 We have blocks for everything except, stuff like: c:\program files\*\* c:\windows\* \\server\netlogon\* \\server\applics\*\* g:\*\* [mapped to \\server\applics\] &c &c, I have done the c:\folder1\*\* as I understood this to mean I can allow to run from c:\folder1\folder2\file.exe, but not from c:\folder1\file.exe, but I'm not completely positive this works.
Zoom7000 Posted June 29, 2009 Author Posted June 29, 2009 We have blocks for everything except, stuff like: c:\program files\*\* c:\windows\* \\server\netlogon\* \\server\applics\*\* g:\*\* [mapped to \\server\applics\] &c &c, I have done the c:\folder1\*\* as I understood this to mean I can allow to run from c:\folder1\folder2\file.exe, but not from c:\folder1\file.exe, but I'm not completely positive this works. I tried %ProgramFiles%\* however, when I log in and try to run programs (e.g. Word) it still says the program is restricted by software restriction policy. What method can I use to run ALL files from %ProgramFiles% not just ones specified in a folder structure.
DMcCoy Posted June 29, 2009 Posted June 29, 2009 What's wrong with the default exceptions when you choose the default policy as denied? I suspect what you have discovered that the .lnk shortcut files are still denied not the contents of program files itself. I'd delete the SRP and start again with the default as deny and add additional allows for the shortcuts. Mine look like this for students: %allusersprofile%\Start Menu\ Security Level Unrestricted Description Date last modified 17/03/2009 16:46:27 %appdata% Security Level Unrestricted Description Date last modified 17/03/2009 16:28:44 %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% Security Level Unrestricted Description Date last modified 17/03/2009 16:27:02 %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% Security Level Unrestricted Description Date last modified 17/03/2009 16:27:02 %systemroot%\System32\runas.exe Security Level Disallowed Description Date last modified 17/03/2009 16:33:49 %userprofile%\Local Settings\Temp\ Security Level Unrestricted Description Date last modified 18/03/2009 09:25:00 %userprofile%\Start Menu\ Security Level Unrestricted Description Date last modified 17/03/2009 16:46:38 *.mdb Security Level Unrestricted Description Date last modified 17/03/2009 16:30:47 \\domain.name Security Level Unrestricted Description Date last modified 17/03/2009 16:31:07 Allowing the domain is useful for the logon scripts, also remember to add and unc paths to application servers \\servername or \\servername\share will suffice, no need for lots of *\*\ etc. 1
Zoom7000 Posted June 29, 2009 Author Posted June 29, 2009 Allowing the domain is useful for the logon scripts, also remember to add and unc paths to application servers \\servername or \\servername\share will suffice, no need for lots of *\*\ etc. Thanks mate. I just created a Test OU and it worked. I'll try it out on the main students! One thing I added to the above was "%AllUsersProfile%\Desktop\" so that they can run shortcuts from All Users Desktop.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now