Software Restrictions

[itgeek]

Hi, we have some student creating .bat and .cmd files. The students can then run the files they have created. I have enabled the following gpo but it is still allowing them to run the files

 

User Config > Policies > Admin Templates > System - Prevent access to the command prompt - Enabled

 

No to - Disable the command prompt script processing.

 

 

I have had a look at the software restrictions however do I just need to put a new patch for example c:\ or the home area i:\ and that should stop them running them?

 

Thanks

[mavhc]

You want to enable applocker/software restriction policies, have it in Disallowed is default mode, and then AllowList things like c:\windows c:\program files, but not c:\users

 

Also add more extensions, eg

 

ADE ADE File

ADP ADP File

BAS BAS File

BAT Windows Batch File

CHM Compiled HTML Help file

CMD Windows Command Script

COM MS-DOS Application

CPL Control panel item

CRT Security Certificate

dll Application extension

efi EFI File

eml Microsoft Email Message

EXE Application

fon Font file

HLP Help file

HTA HTML Application

INF Setup Information

INS INS File

ISP ISP File

jar JAR File

js JavaScript File

jse JScript Encoded Script File

MDB MDB File

MDE MDE File

MSC Microsoft Common Console Document

msg MSG File

MSI Windows Installer Package

MSP Windows Installer Patch

MST MST File

OCX ActiveX control

PCD PCD File

PIF Shortcut to MS-DOS Program

ps1 Windows PowerShell Script

psm1 Windows PowerShell Script Module

REG Registration Entries

SCR Screen saver

sct Windows Script Component

shb SHB File

SHS SHS File

sys System file

URL Internet Shortcut

VB VB File

vbe VBScript Encoded Script File

vbs VBScript Script File

WSC Windows Script Component

wsf Windows Script File

wsh Windows Script Host Settings File

xlm XLM File

 

 

At that point a few things will break, and you can allow them based on certs or hashes, eg MSTeams installed in AppData

[clareq]

Have a look in User Config - Policies - Admin Templates - System - Don't run specified Windows applications. I've got cmd.exe and powershell_ide.exe in there, amongst others. I also have Restrict these programs from being launched from help, with cmd.exe in there.

[jthompson]

Use AppLocker to enforce rules that prevent students from executing scripts from any locations that they are able to write to. (https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker).

 

You can also use FSRM to set a file filter on user areas that prevent students from writing .bat or .cmd files (and others) to their user areas, just to drive the message home.

[jthompson]

Have a look in User Config - Policies - Admin Templates - System - Don't run specified Windows applications. I've got cmd.exe and powershell_ide.exe in there, amongst others. I also have Restrict these programs from being launched from help, with cmd.exe in there.

 

There are several PowerShell executables, which I believe would all need to be blocked. I'm using that GPO option to block each of these:

 

%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe

%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe

%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell_ise.exe

[itgeek]

Thanks,

 

I have just had a look and does applocker block all scripts in a specific location. Can you just select all scripts block without having to select individual locations etc?

 

Thanks

[mavhc]

That would block essential scripts that windows or other apps might run, you want to block them for anywhere a non admin user can write to

[Julian]

Please look at "File Server Resource Manger", on the server where the students work is stored. It has a file filter feature, (and storage quotas). It can be set to delete all executables. Students will find it impossible to run a file, that is deleted, the moment the system sees it as executable.

[jthompson]

Thanks,

 

I have just had a look and does applocker block all scripts in a specific location. Can you just select all scripts block without having to select individual locations etc?

 

Thanks

 

With an AppLocker policy enforced, scripts will be blocked by default. Rules added to the policy will then allow for scripts to be run from certain locations where its necessary (iirc there is a default ruleset that you can get it to add, which allows for stuff to be run from C:\Windows, etc.). Make sure that those are only covering locations that your end users aren't able to write to.