Preventing File Extensions through GPO

[flexyjerkov]

Need help with preventing students from running specific file extensions from either USB Drives or there own user area. Would ideally like to be able to achieve this through GPO if possible.

 

Can Anyone help?

[ricki]

Me too

 

Richard

[User3204]

You want "Software Restriction Policy", do a search around edugeek.

 

Start here How To Use Software Restriction Policies in Windows Server 2003

then go here Using Software Restriction Policies to Protect Against Unauthorized Software for more info.

 

You can add/remove extra file extensions from the allowed list if necessary, although I'm not sure what this would do to an XLS/DOC file...

by default, it blocks anything you class as an application, BAT, COM, EXE, VBS, etc, etc, we're at the stage where we're going to stop SWF files too, but they still work when embedded into XLS etc.

[flexyjerkov]

You want "Software Restriction Policy", do a search around edugeek.

 

Start here How To Use Software Restriction Policies in Windows Server 2003

then go here Using Software Restriction Policies to Protect Against Unauthorized Software for more info.

 

You can add/remove extra file extensions from the allowed list if necessary, although I'm not sure what this would do to an XLS/DOC file...

by default, it blocks anything you class as an application, BAT, COM, EXE, VBS, etc, etc, we're at the stage where we're going to stop SWF files too, but they still work when embedded into XLS etc.

 

what we are looking at doing is restricting specific files from a specific drive as we could quite easily block all exe though we would get ourselves into a lot of problems.

[flexyjerkov]

Right, i've managed to get a policy working to lock down the users my documents and prevent file access. Next is them blasted USB Sticks.

 

User Configuration > Windows Settings > Security Settings > Software Restriction Policies > Additional Rules

 

Create new path to: %HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Personal%*

 

Set to disallowed.

 

Then anything in:

 

User Configuration > Windows Settings > Security Settings > Software Restriction Policies > Designated File Types

 

will be disabled.

[AngryITGuy]

For your USB problem, see the following thread for more information, found it useful when I was in the same boat as you.

 

We use USBDLM on all workstations here which forces all USB devices to use either drives X, Y or Z. We then have path rules assigned to each of these drives locking down access to innapropriate file types.

[buzzard]

For your USB problem, see the following thread for more information, found it useful when I was in the same boat as you.

 

We use USBDLM on all workstations here which forces all USB devices to use either drives X, Y or Z. We then have path rules assigned to each of these drives locking down access to innapropriate file types.

 

Beat me to it! I second that solution works great for me

[clarky2k3]

Yeah USBDLM is the way to go!

[flexyjerkov]

Well i've just added all the drives which could possibly be usb devices to the disallowed list like: "J:\*"

[flexyjerkov]

Success!

 

Had a few youngsters come down to the office today...

 

Them: "Mr IT man... We got firefox portable on our USB sticks and its stopped working"

Me: "and?"

Them: "Can you allow us to use it as IE7 is horrible and we don't like microsoft"

Me: "Nothing wrong with IE7 and it even supports tabbed browsing so get used to it"

Them: "But you are using firefox"

Me: "I don't like IE7 its too slow"

 

Kids look confused and walk off in a huff and talk over ways to get around it. (which they wont do but ill let them try for the fun of it)

 

 

Thanks for all the help in getting this damn policy working

[petectid]

Success!

 

Had a few youngsters come down to the office today...

 

Them: "Mr IT man... We got firefox portable on our USB sticks and its stopped working"

Me: "and?"

Them: "Can you allow us to use it as IE7 is horrible and we don't like microsoft"

Me: "Nothing wrong with IE7 and it even supports tabbed browsing so get used to it"

Them: "But you are using firefox"

Me: "I don't like IE7 its too slow"

 

Kids look confused and walk off in a huff and talk over ways to get around it. (which they wont do but ill let them try for the fun of it)

 

 

Thanks for all the help in getting this damn policy working

 

You could roll out Firefox for all your pupils and lock it down in group policy using the Firefox adm available from SourceForge

[ChrisH]

SRPs also stop these nice viruses that they seem to have on their USB drives. Sophos tends to delete their autorun.inf files as well which is good for a change.

[techie211]

For your USB problem, see the following thread for more information, found it useful when I was in the same boat as you.

 

We use USBDLM on all workstations here which forces all USB devices to use either drives X, Y or Z. We then have path rules assigned to each of these drives locking down access to innapropriate file types.

 

did you push down the .msi? how did you edit the USBDLM.INI? did you unpack the msi first? I want to use the .msi because of the quantity of computers we have but not sure how 'assigning the drive letters' works this way.

If anyone has any input on this I'd appreciate it.

[DrPerceptron]

I don't remember how we went through, just follow the instructions, I tweaked it for something, but I don't remember what or why I did...

 

We just push it out using the exe as part of our default startup script

[Tamarside]

Assign the .MSI to computers, then a day or two later add a few lines to a startup batch script assigned to the computers to copy your edited .INI file into place on all workstations, from your NETLOGON share.

 

Take the example .INI file and tweak it to suit your needs - the app has a great deal of documentation to show you how to do this.

[IrritableTech]

did you push down the .msi? how did you edit the USBDLM.INI? did you unpack the msi first? I want to use the .msi because of the quantity of computers we have but not sure how 'assigning the drive letters' works this way.

If anyone has any input on this I'd appreciate it.

 

I made a script to robocopy the program and associated files over to the client. I then used the same script to run a silent install (USBDLM -silentinstall) to register the service.

[Aaron]

Hi Everyone.

 

Can someone please help me with this small problem, we have started a legacy network in our school and has been running from September with little problems here and there but nothing that hasn’t been able to get sorted thanks to this site.

 

I am finding more and more pupils are using their usb memory sticks to run games and i wanted to know now that i have the system running can I stop .exe from running on memory sticks as well as on their my documents. Also I have run into a pupil who is able to access cmd prompt all be it he hasn’t been able to do anything serious but I want to stop cmd prompt access completely so no .bat files or anything can be run for pupils. I have this enabled in GPO that they cannot access cmd but he still finds ways round.

 

Is it possible to disable .exe from running on memory sticks? I have this morning changed security settings while reading this post and I will see how this affects computers on Monday morning. I have changed all settings on computers and pupils security to default security but I was thinking of changing this to disallowed and stopping access to everything and really release access when I am asked.

 

Please any help with this would be much appreciated

[Tamarside]

You'll find detailed instructions on this thread, which several others have linked to further above: http://www.edugeek.net/forums/windows/7041-stopping-exe-files-being-run-usb-stick.html

[cookie_monster]

We use software restriction policy for this and it works well, it has the added benefit that you can prevent the running of exes from anywhere other than areas that you explicitly allow.

[Aaron]

which software restrictions have you in place to stop this?

[Tamarside]

Go have a look at post 5 in the thread I've linked to above. As I said, there are detailed steps there.

[cookie_monster]

Go have a look at post 5 in the thread I've linked to above. As I said, there are detailed steps there.

 

 

And the link below and example.

 

%AllUsersProfile%\Desktop\ Path Unrestricted
%AllUsersProfile%\Start Menu\ Path Unrestricted
%AppData% Path Unrestricted
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% Path Unrestricted
%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur rentVersion\ProgramFilesDir% Path Unrestricted
%SystemRoot%\System32\runas.exe Path Disallowed
%UserProfile%\Desktop\ Path Unrestricted
%UserProfile%\Local Settings\Temp\ Path Disallowed
%UserProfile%\Start Menu\ Path Unrestricted
*.mdb Path Unrestricted

 

http://www.edugeek.net/forums/networks/13168-software-restriction-policies-allow-only-certain-software.html

[wgpcollege]

I have followed through this thread but I'm still having problems getting my policy to take effect.

 

I have a user GPO set for students which restricts their home drives, flash drives etc. I have all the default Designated File Types in there which work well. But any additional file types I add in (such as swf) don't work and can still be opened.

 

Can anyone help me?