Quarantine OU/GPO and Software Restriction Policy

[lafayette7674]

I am trying to create a quarantine policy for machines that have vulnerabilities. I need minimal software access and no internet connectivity. I have configured a proxy server of 0.0.0.0 and disabled the ability to change the proxy server for items in the OU with the Quarantine GPO. I need to enable software restriction which I have done following a TechNet article. I have the default set to "Disallow." The same is configured in User Configuration. However....... Programs are still running just fine. Namely, Microsoft Outlook. We need NO email access. I would like to create a hash rule however I can't do that because the program isn't installed on the servers, obviously, therefore I cant browse to the program and select it in the hash rule. If there is another way to create rules to stop software from running please advise. I have the software restriction policy set per Computer Configuration> Policies> Windows Settings> Security Settings> Software Restriction Policies> Additional Rules. Please see the attached screenshot. Thank you for your assistance. Again, specifically we do not want Outlook to run.

 

Edited August 21, 2017 by lafayette7674

[eddyc]

If you install the RSAT (Remote server administration tools) on a workstation where outlook is installed, you can edit the group policy objects from the workstation and browse locally to Outlook to create your hash rule.

 

Hope that helps!

[lafayette7674]

We know this. However, we operate in a strict network environment and RSAT is NOT authorized on workstations. I should have said that wasn't an option in the OP but thank you kindly for your response. So, unfortunately, this is not an option.

[Arthur]

I would like to create a hash rule however I can't do that because the program isn't installed on the servers, obviously, therefore I can't browse to the program and select it in the hash rule.

The easiest way would be to temporarily copy the Outlook executable (i.e. just outlook.exe) to your server in order to generate the hash rule and then delete it afterwards.

[lafayette7674]

Thank you but our network policies are even more restrictive on servers. Oh that blasted compliance! lol

[Arthur]

our network policies are even more restrictive on servers.

Do you have a workstation that has the ability to edit GPOs and can have outlook.exe copied over to it?

[Steve21]

What's the actual path you're using for Outlook? (Doesn't show fully on screenshot) As there's no reason a simple path block shouldn't work unless it's pointing somewhere wrong or something else is an issue like the GPO not applying.

 

In regards to the hash you could just browse the hidden admin share from the server and select it too, but again shouldn't need a hash in regards to making the path rule work.

 

Steve

[Arthur]

In regards to the hash you could just browse the hidden admin share from the server and select it too

That might be against company policy too.

[lafayette7674]

Why would that be against our network policy, Arthur? How would you know? Seriously, I was just posting the way I was so no one spent too much of their time sharing the first things first types of ideas. Moving on. I will give browsing to the hidden admin share a go. That's the type of answer I was looking for. Another way to get that hash rule to work. Thank you for your response Steve.

 

I took the idea you offered and ran with it. We will test it and see. If it doesn't work I don't really know what else to try. We have separation of duties so at that point I will transfer it to the desktop guys.I used this path:

 

\\127.0.0.1\c$\Program Files (x86)\Microsoft Office\Office15\OUTLOOK.EXE

Edited August 23, 2017 by elsiegee40
Language

[Arthur]

How would you know?

It was just a joke. Sorry if I have upset you. That wasn't my intention.

 

Why would that be against our network policy, Arthur?

If you can browse to the admin share on a PC that has the potential to be infected due to its vulnerabilities from a server which is not authorized to have executables copied to it (and no doubt other restrictions). Surely that's a bit risky?

 

SRP can be bypassed* (like AppLocker) so I assume you have additional layers of security in place?

 

* See Casey Smith's Twitter feed for plenty of examples and the link below.

 

https://github.com/subTee/ApplicationWhitelistBypassTechniques/blob/master/TheList.txt

Edited August 23, 2017 by elsiegee40

[ZeroHour]

MOD NOTE: Please stick to the topic all.

 

Have you considered using Group Policy File/Folder permissions to deny access to the folder as a workaround for now? I know its not what you were aiming to use but you could just create the folder path on the server temporarily then use GP to deny access to it and remove it after. You wouldnt need to copy the exe at least.

[Steve21]

I took the idea you offered and ran with it. We will test it and see. If it doesn't work I don't really know what else to try. We have separation of duties so at that point I will transfer it to the desktop guys.I used this path:

 

\\127.0.0.1\c$\Program Files (x86)\Microsoft Office\Office15\OUTLOOK.EXE

 

That wasn't what I said as that deffo won't work People won't be accessing it via that path. Especially seeing that's a loop address.

 

My point was if you browse to the hidden drive from the server, you could just select the exe of Outlook as part of doing the hash rule.

 

Steve

[Arthur]

If it doesn't work I don't really know what else to try.

If you have a separate non-production domain that is less restrictive you could create all the SRPs on there, export the GPO containing the SRP rules (inc. any Outlook hash/path rules) and restore it on the production domain?

 

https://technet.microsoft.com/en-us/library/cc754760(v=ws.11).aspx

 

Backup-GPO -Name 'GPO containing SRP rules' -Path "C:\Backups"

 

Restore-GPO -Name 'GPO containing SRP rules' -Path "C:\Backups"

Edited August 23, 2017 by Arthur

[lafayette7674]

This is why I used the loopback address.

 

So, a UNC path uses the "user-friendly" hostname OR an IP address... SOOOO... Since that is the IP address of every host with the loopback adapter installed AND every host on our network has the loopback adapter installed; rather than use the hostname which is DIFFERENT on every host I used the loopback address... AAAnd it worked fine. That's because it's the hidden admin share for EVERY workstation and it doesn't rely on DNS, not that it matters, but it also means I don't have to create an entry FOR EVERY machine using "what you said." Further, I'm not going to share the naming convention of our organization and it "deffo" did work. I digress.

Edited August 23, 2017 by elsiegee40
Language

[elsiegee40]

 

Further to ZeroHour's comment earlier.

 

Bad language and disrespect of other members will not be, and never has been, tolerated on EduGeek.

 

OP you are a new member on EduGeek and nobody has any knowledge of either your setup or your experience. After over 30 years in this trade, even I find it useful to take things back to first principles on occasion to try to solve an issue.

 

I am sure you have a big problem and other members are genuinely trying to help; getting stressed with them because you have tried what they're saying already, or for any other reason, isn't going to encourage them to try to understand what's going on.

 

Now I suggest EVERYONE take a deep breath, chills and tries to think things through and NOBODY badmouths anyone else if they said something that appears to be dumb to somebody else.

 

Edited August 23, 2017 by elsiegee40

[Steve21]

Oh well, Seeing once again you didn't read what I said and apparently know better and as people say you're taking everything personally I'm out wasting my time.

 

If you need to sort it I suggest you read up about how hash rules work and loopback address as mentioned above what you said won't work on any network as that path "isn't" used by a user, it's an "admin" share.

 

Hope you get it to work one way or another

 

Steve

[markwilfan]

Oh well, Seeing once again you didn't read what I said and apparently know better and as people say you're taking everything personally I'm out wasting my time.

 

If you need to sort it I suggest you read up about how hash rules work and loopback address as mentioned above what you said won't work on any network as that path "isn't" used by a user, it's an "admin" share.

 

Hope you get it to work one way or another

 

Steve

For sanity @Steve21 I get you. All the op needs to do is create a hash value of an exercise so using the administration share will allow the to achieve that. Exactly how I would do it bearing in mind the ops compliance rules