Block student running shortcuts

[petben]

We need to find a way to prevent students running shortcuts from various locations. Software Restriction Polices seems like the answer, which we already use for .exe etc, and .lnk files are there by default, but shortcuts (which definitely have the .lnk file extension) still work.

 

Thanks for any ideas.

[bknaggs]

Can you restrict access to the location where the shortcuts are stored if you don't want students accessing them?

[petben]

we already do that, so a student brings in a shortcut to powershell on a USB stick (say Drive E: ), software restriction policies already dictate .lnk files are blocked from E:\ but the shortcut still runs....

[chazzy2501]

You can block locations at the computer and user level, with the shortcuts you must explicitly block both.

 

But you should reverse the model and block all exe's and allow only the ones you want. (but perversely you'll want to exclude .lnk files) you'll find out why.

[bknaggs]

Work out a list of programs/system tools you don't want students running and explicitly block them. That way it doesn't matter if they are bringing in a USB with shortcuts on they won't launch the exe they point to.

[petben]

we cant block PowerShell.exe because the logon scripts need it and they run as the user. Students can do all kinds of stuff in PowerShell.

 

chazzy2501 can you please elaborate on how your SRP are setup, you seem to have fixed this on your network?

We are concerned that machine SRP will get in the way of admin user.

 

Thanks

[chazzy2501]

sure this is a pupil gpo, first the pupil SRP I set the default setting to "disallow" so no pupil can execute anything. I then added additional path rules to allow certain directories. The GPO will fill in 2 default directories so nothing will break, then add your own, I added the program files directories and our mapped Y drive for network programs.

 

This seemed like a good solution as you need admin creds to place anything in the program files directory and our mapped drive is read only. Sure you can still smuggle an executable in but you can never run it.

 

This was 99% perfect BUT I need the shortcut links to work in the taskbar on windows 8.1 (file explorer and ie) but these .lnk files can't be excluded using the path rules. I decided to exclude .lnk files from the executables list. This I had to do on both the user and the computer settings.

[petben]

do you find that when you set the default to 'disallow' the shortcuts (.lnk) files are blocked? We can not get shortcut files to be blocked no matter what we do....

 

Thanks

[Arthur]

We can not get shortcut files to be blocked no matter what we do....

Could you not block the targets of the shortcuts?

[petben]

thanks, we cant block PowerShell.exe because the logon scripts need it and they run as the user.

[chazzy2501]

did someone run your system before you? they could have removed the .lnk file type from the executables list.

 

but to your first point in a disallow by default it certainly stopped shortcuts. But are you talking about shortcuts or .ps1 files?