Students hiding games as doc files

[enjay]

Some of our students have wised up to our file extension blockers and searches, and started renaming .js files as .doc then sharing them via OneDrive, downloading and renaming the file when they want to play the game. As a stop-gap, I've blocked students from running javaw.exe but that isn't viable in the longer term because of Computing's requirements.

 

How do you guys deal with this?

[tmoon-mint]

Depending where your student home folders / downloads are use file server resource manager to block certain file extensions from being saved in their home folders? Works for me I stop students from saving any executable files.

 

Using this method if they tried to rename .DOC to something else like .exe they would just get access denied.

[LeMarchand]

Use GPO to remove the view file extension option?

[mavhc]

Why did you block java?

[enjay]

Why did you block java?

 

Because the students were using it to play Minecraft

[MatthewL]

Used to do that when I was at school, one of the oldest tricks going that!

[enjay]

Depending where your student home folders / downloads are use file server resource manager to block certain file extensions from being saved in their home folders? Works for me I stop students from saving any executable files.

 

Using this method if they tried to rename .DOC to something else like .exe they would just get access denied.

 

We've currently got that set up in passive mode. It alerts when they download/save a an executable but doesn't notice them rename a file. You're saying if we set it to active, it would stop the renaming too?

[tmoon-mint]

We've currently got that set up in passive mode. It alerts when they download/save a an executable but doesn't notice them rename a file. You're saying if we set it to active, it would stop the renaming too?

 

Believe so yes. We have the setup that was posted on here that prevents known ransomware file names and extensions from writing to our file servers as well and I cant rename a .TXT file to .LOCKY for example.

[6Foot2]

Depending where your student home folders / downloads are use file server resource manager to block certain file extensions from being saved in their home folders? Works for me I stop students from saving any executable files.

 

Using this method if they tried to rename .DOC to something else like .exe they would just get access denied.

 

Block in more areas than home folders if you have other areas where students can save files (our teachers requested a central location on the network where students could submit homework) I divided the drive up into folders with names requested by the teaching staff. Students could only drag and drop files onto the folders, but not see inside.

 

Staff could, however, see and manage the contents of the folders they requested but not other folders (we had quite a few "clumsy" staff who often "lost" important files)

 

[mavhc]

is applocker/srp not working for jar files? can you run java with a jar file when it's been renamed?

[jthompson]

We've currently got that set up in passive mode. It alerts when they download/save a an executable but doesn't notice them rename a file. You're saying if we set it to active, it would stop the renaming too?

 

Yes, it will prevent them from renaming a file to something with an extension not allowed by FSRM. It'll present in the same way as if they didn't have write privileges on the location (i.e. access denied, insufficient privileges, etc.).

[enjay]

Yes, it will prevent them from renaming a file to something with an extension not allowed by FSRM. It'll present in the same way as if they didn't have write privileges on the location (i.e. access denied, insufficient privileges, etc.).

 

Unfortunately enforcement of the FRSM policy isn't going to work, as it will impact the Computing department too much. Passive monitoring picks up students saving executable files, but it doesn't spot them renaming files.

 

I might give up on this line of thought, and just look at how I can block the games at a firewall level (which will then just push the students towards offline games, of course!)

[6Foot2]

Would a classroom management solution help? [e.g.: Impero, or other]

 

Perhaps you already have one, but as I recall Impero was helpful for me in this regard.

[enjay]

Would a classroom management solution help? [e.g.: Impero, or other]

 

We've got NetSupport, I'm just trying to find a way to stop it at source if possible.

[mavhc]

Block windows with Minecraft in the title.

 

Do you have SRP/Applocker?

[enjay]

Block windows with Minecraft in the title.

 

That would go some of the way. How do I do that? I know how to block specific applications by .exe name or location, but not by window name.

 

SRPs blocking all executables aren't an option because of Computing.

[Koldov]

Can you not block all and then make exceptions for Computing?

[enjay]

Can you not block all and then make exceptions for Computing?

 

FSRM runs on the path to the profile folders, D:\Student Profiles\2020 or whatever, so that's out.

 

Can you target GPOs to apply to everyone except the specified group? I don't fancy maintaining an AD group of everyone who isn't a Computing student.

[jthompson]

If you've got AppLocker you could block executions by default, but then have a supplementary GPO applied to your Computing computers that includes the rule(s) needed to allow it on those machines. That would mean that AppLocker, rather than FSRM, is providing the restrictions to prevent students running their own executables, except for when they're on Computing machines.

[dmj]

I solved this issue by setting up an intermediate script in that gets run when the file is saved. The action of saving to the share ran the file command which checked the file against 'accepted' file types. The command checks the file, not the extension (which is a weird microsoft construct).

[SamanthaD]

Part of me thinks this isn't a technical problem - it's a classroom management problem and teachers need to be taking the responsibility of what students are doing with their time rather than trying to push it onto you.

[jthompson]

I'd say it's a technical issue in as much as it's a matter of application allowlisting being needed. Any classoom management problems then sit above that.

[TechMonkey]

It isn't a technical issue, it is a technical solution is being applied to a classroom management issue that happens to use technology. What if a pupil brought a magazine in and read it in class? What if their way to hide that was hiding it in a text book? Extend that to what if the magazine was a Kindle? Same issue. Classroom staff need to be aware of what is going on in their classrooms. We can try and help to minimise issues but at some point it needs boots on the ground to do their jobs.

Another way to look at it, you play cat and mouse for months over this, finally lock it down. Do you win? Are all IT classroom distractions banished forever? No, they will find another one to chase your tail over by the end of the day. Alternatively if the school set expectations, help teach kids to manage their time and understand the consequences if they don't then everyone wins!

 

I know, I know, what a big hippy, fluffy, kumbaya answer, it will never work, have I never worked with kids, what do I know. Just a thought though.

[mavhc]

The Computing lessons require making exe files? I just use Python.

 

Can you apply SRP to some computers/users but not others?

 

Blocking by windows title requires some extra program running, Impero does it for me here

[jthompson]

It isn't a technical issue, it is a technical solution is being applied to a classroom management issue that happens to use technology. What if a pupil brought a magazine in and read it in class? What if their way to hide that was hiding it in a text book? Extend that to what if the magazine was a Kindle? Same issue. Classroom staff need to be aware of what is going on in their classrooms. We can try and help to minimise issues but at some point it needs boots on the ground to do their jobs.

Another way to look at it, you play cat and mouse for months over this, finally lock it down. Do you win? Are all IT classroom distractions banished forever? No, they will find another one to chase your tail over by the end of the day. Alternatively if the school set expectations, help teach kids to manage their time and understand the consequences if they don't then everyone wins!

 

I know, I know, what a big hippy, fluffy, kumbaya answer, it will never work, have I never worked with kids, what do I know. Just a thought though.

 

I appreciate that, which is why I say that any specific classroom management issue here exists on top of the more general issue of getting application allowlisting in place. Application allowlisting isn't there to address student timewasting necessarily, and you'd want it even if all your users were reliably well behaved.