Allow download restrictions GPO

[Bankesy]

Good afternoon,

 

Wondering if somebody can help me with this please? I've noticed that in my new environment downloads from browsers are being blocked, things like .exe and .xml (for SIMS CTF files).

 

I figured it was a GPO preventing this and indeed upon testing this appears to be the case and I have found an existing GPO which has 'Allow download restrictions - Enabled \ Download restrictions - Block dangerous downloads' for both Chrome and Edge.

 

I haven't seen or used this policy before so I'm wondering if:

 

A) that is set correctly because it seems super restrictive

B) if it's set correctly is there a way I'm supposed to allow exceptions

 

Thank you

[georgeescott]

A) that is set correctly because it seems super restrictive

B) if it's set correctly is there a way I'm supposed to allow exceptions

 

A) It really depends on your environment and how restrictive you want to be for downloads that have the potential to be malicious.

Looking at Edge, ‘BlockDangerousDownloads’ will “Block malicious downloads and dangerous file types”. A sensible setting to protect users, but this won’t allow them to override the block.

https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#downloadrestrictions.

 

B) In Edge, there is an exceptions list you can set https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#exemptfiletypedownloadwarnings to allow specific domains/filetypes through. Alternatively, you could leave it un-configured or set the 'DefaultDownloadSecurity' option and this will continue to block them, but allow users to ‘keep’ it via a context menu option.

 

Worth a read: https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-downloads-interruptions.

[FN-GM]

You shouldn't be using the browser at all on a server. Best security is to have the internet blocked completely on a server. The exception is a terminal server.

[Bankesy]

@FN-GM

 

My apologies, the query concerns client devices. I just posted here because because I'm using group policy on Server 2019 and couldn't see another sensible thread for the query.

 

Thank you

[round2it]

just apply it to student ou, or use fileserver resource manager to block exes from the downloads folder

[FN-GM]

@FN-GM

 

My apologies, the query concerns client devices. I just posted here because because I'm using group policy on Server 2019 and couldn't see another sensible thread for the query.

 

Thank you

 

Ah sorry! Maybe I shouldn't have assumed!

[Bankesy]

@round2it

 

I'm not trying to block it entirely, at this particular point I'm trying to make it so staff can download the SIMS CTF files they need (XML) but the way the current policies are setup for Chrome and Edge prevents this.

 

Thanks