Students are installing IM apps to their home folder

[Norphy]

I installed a piece of freeware called USB Drive Letter Management, which allows you to specifiy what letter a USB device gets when it is plugged in, then I crudely had to add into the Software Restrictions in GPO deny *.exe, then *.*\*.exe, then *.*\*.*\*.exe.... for a good few levels as there's no way to specify the whole drive. The students could get round it if they put an exe in a deep enough subfolder, but I'm hoping they'd give up before getting that far

 

I have to say, I think you're going about it back to front. Its much easier to deny everything then put in a whitelist of files you want run than it is to blacklist everything you don't want run. As long as you allow anything in Program Files and a couple of other choice directories (Kudos for example) you're laughing.

[Richie1972]

There are all sorts of exe's running - yes, a lot in program files, but also other places - i'd rather not develop huge lists of programs to exclude from the list and simply block the areas where i know they shouldn't be running exe's

[fooby]

I'm sure I have added drive letters to Software Restriction Policies.......

 

 

fooby

[Richie1972]

You can add drive letters, however, something like: p:\*.exe only blocks exe's in the root, you have to specifiy a block on each level through the directory structure in software restrictions

[wrighty]

Add a new path rule as follows to stop exe's etc from running in a users homefolder and subfolders:-

 

%homeshare%*

[tom_newton]

You have to lock down pretty hard if people change ports, but the firewall is a good place for this; prevent the IM working, and you remove the temptation to download