Students are installing IM apps to their home folder

[bwallman]

Some student have figured out that they can install software to their home folder on the server. We have a Windows 2000 domain with XP clients, when students log on, the GPO locks the clients up tight (or so we thought). The two Instant Messaging apps they are usually installing are Trillian and Easy Messenger. We've been able to block most web sites that have the Easy Messenger file but Trillian is more of a pain.

 

Does anyone know you can prevent users from installing software to their home folder?

[ChrisH]

I think in your environment this might be your best bet.

[russdev]

also can be done with gpo having certain drives and locations set to allow list only

 

russ

[ChrisH]

Is that available in windows 2000 server I dont remember it being?

[bwallman]

also can be done with gpo having certain drives and locations set to allow list only

 

russ

 

Can you point me in the direction of how to go about doing this?

 

Thx

[russdev]

i kew people was going to ask that i didnt set this up here (as rm network) but it uses just standad windows 200 parts....

 

http://technet2.microsoft.com/WindowsServer/en/Library/eca4c4cd-335a-4b33-8f1f-0f139e6024b21033.mspx

 

but it has it advantages and disadvantages

 

remember to set allow to run all from programs dir...

 

it takes lot fo work to get it set up.

 

Russ

[_Bob_]

Pretty sure this is a 2k3 only thing. We use it here. Takes a bit of fiddling to set up, but works a treat.

[russdev]

aslong as clients are xp think it can be done...

 

well rm do it and they dont use anything different other than ms stuff

 

russ

[CyberNerd]

We solve this by allowing using an 'allowed applications' list in 2000 server.

Some antivirus solutions also allow only 'allowed' applications. (McAfee).

It is also possible to prevent certain applications (.exe etc) from being stored in certain areas using SAMBA and have it email you violations.

[pcprofessor]

two other relevant threads are: "blocking .exe" in the windows forum and "portable apps" in the general chat forum. the common answer seems to be the use of Software Restriction Policies.

[adamyoung]

You could run Nasty File Search on they're home dirs, this could be set to automatically delete DLL's, EXE's etc

 

For IM you could look into blocking the ports on your firewall.

[CyberNerd]

could use a samba filesystem and prevent .exe .dll from being stored on the homedrives. Many more options/possibilities with sama.

 

edit: lol I replied to the same post twice - I must be loosing it

[stejefferies]

ports can be changed in Trillian, or a port forwarding utility. another problem we have is there is an a level programming course, and they write in C (and some in assembler), C Sharp, and .NET.

 

pain when you look through the names.

 

we use a service that blocks pretty much anything on any port (unless we need it, and ask them), however another school i know, uses thier own ISA server to block everything. Brilliant.

[Geoff]

Linux box in bridging firewall mode can pick/block this stuff up too.

 

Alternatively you can passively monitor for it with snort assuming your switch(s) support port mirroring.

[TechMonkey]

If it's XP SP2 could you not use the built-in firewall to stop everything but what you specifically want?

[fooby]

You can quickly apply the deny execute special permission to the students group to the home folders, this way they cannot execute software from the home shares.

 

However, setting up software restriction policies is essential, i think i may have gone overkill in my setup of SRP however no one, thats no one can install anything i dont allow

[Geoff]

If you remove the execute permission from folders you can't open them. Make sure you only remove the execute permission on files.

[fooby]

:-O i didnt know that

[Geoff]

XP SP2 has no outbound protection. There's API's that the program running on the machine can use to open ports for incomming connections. So no, its no help.

[Ric_]

There's also the Becta-preffered method of stopping this thing (although it's less effective) using School policies - threatening to remove an a-level kid's login will mean that they can no longer do their work and this effectively means they lose their place at the school.

 

Speak to your SMT to see how policies could be implemented.

[Richie1972]

We've used GPO and folder security settings (deny execution of files) to block running of exe's.

You'll then find the kids will start running exe's from their USB drives (if, like us, you haven't blocked them from using USB drives).

All we did then was install a program to make sure that their USB drive installed as Z:, Y:, or X: (in case they tried to install more than one drive) and prevented running of exe's via GPO.

The little darlings will find ways around that, too, I'm sure

[ChrisH]

.... You say you installed a program? People want details

[Richie1972]

I installed a piece of freeware called USB Drive Letter Management, which allows you to specifiy what letter a USB device gets when it is plugged in, then I crudely had to add into the Software Restrictions in GPO deny *.exe, then *.*\*.exe, then *.*\*.*\*.exe.... for a good few levels as there's no way to specify the whole drive. The students could get round it if they put an exe in a deep enough subfolder, but I'm hoping they'd give up before getting that far

[ajbritton]

I installed a piece of freeware called USB Drive Letter Management...

 

Hmmm. Googling for "USB Drive Letter Management" returns a a big fat zero hits. Can you remember where you got it from?

[ajbritton]

Would it be USBDLM (USB Drive Letter Manager)???