Arduino IDE Port Option Not Showing

[Zbd]

Hi, This is more for the benefit of Google than anything.

 

When we deployed the Arduino IDE v2 MSI. We found that our under "Tools" we found that our students had no "Port" option between "Board" and "Get Board Info".

 

We knew it was a Active Directory Group Policy User Restriction as both Local Admin and Staff could see the option however students couldn't. All the Google search results came up about a lack of drivers however that was not our issue.

 

We traced it to the fact that our Students cant run any executables on their home drives, so we had to add the exception to the below folder:

 

C:\Users\%USERNAME%\AppData\Local\Arduino15\

 

If anyone can be more specific I'd be grateful from a security point of view

[Ghosty2]

I'm having a similar issue does anyone know the answer here

[Ghosty2]

How did you add the exception? you done this on app locker group policy?

 

Hi, This is more for the benefit of Google than anything.

 

When we deployed the Arduino IDE v2 MSI. We found that our under "Tools" we found that our students had no "Port" option between "Board" and "Get Board Info".

 

We knew it was a Active Directory Group Policy User Restriction as both Local Admin and Staff could see the option however students couldn't. All the Google search results came up about a lack of drivers however that was not our issue.

 

We traced it to the fact that our Students cant run any executables on their home drives, so we had to add the exception to the below folder:

 

C:\Users\%USERNAME%\AppData\Local\Arduino15\

 

If anyone can be more specific I'd be grateful from a security point of view

[k-strider]

so the original post was a software restricion policy (predecessor to app locker)

im playing with App Locker to replace SRP and so far we think this path rule will work in app locker C:\Users*\AppData\Local\Arduino15* we have it in audit mode and it seems to be running and allowed to in the event log - but idealy we are going to see if we can do this with hashes for all the exes and bat files instead of path rules. we put it in Executible rules and Script Rules

[k-strider]

Just to update using these PS scripts (doesnt work in 7.3.3 but ok in 5) can create the Hases and it seems to work ok i hashed them on Aurdino 2.0.4 and our labs have 2.0.2 and these seem to not have changed as they are running ok and ok in the event log too

 

Get-ChildItem C:\Users\USERNAME\AppData\Local\Arduino15\*.exe -Recurse | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -RuleNamePrefix AudionTest -Xml > AppLocker_Audion.xml

 

Get-ChildItem C:\Users\USERNAME\AppData\Local\Arduino15\*.bat -Recurse | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -RuleNamePrefix AudionTest -Xml > AppLocker_Audion_scripts.xml

 

i then exprted our current policy and opened the XML and added the new Hashes in to the two sections of the exported policy and then re imported it to get all the rules in. it looks like from powershell you can merger them into the GPO

https://4sysops.com/archives/managing-applocker-with-powershell/

Set-AppLockerPolicy –XMLPolicy .\MDOP.XML -LDAP "LDAP://DC-01.TEST.local/CN={GUID},CN=Policies,CN=System,DC=TEST,DC=local"

If you have existing rules within this policy, be sure to use the –Merge switch.