Kids bypassing dos restrictions

[mrbios]

Kids have just discovered that they can write an msdos batch file containing just "command" to bypass the GPO restrictions on command prompt, does anyone know of a way (without disabling script access) that we can lock this down?

 

It's so simple so im sure someone has delt with it before

[matt40k]

Disable command prompt

Disable .bat (file storage)

Software security policy - stop executable from running outside of C:\, then hide access to C: to the end user.

[mrbios]

Disable command prompt

Disable .bat (file storage)

Software security policy - stop executable from running outside of C:\, then hide access to C: to the end user.

 

1. done already

2. Set but doesn't appear to be taking effect properly, will look into that

3. done already

[Oops_my_bad]

Software security policy - stop executable from running outside of C:\, then hide access to C: to the end user.

 

Can I ask how you do this?

[mcloum]

Disable .bat (file storage)

Software security policy - stop executable from running outside of C:\, then hide access to C: to the end user.

 

 

Ditto, would also like to know how to disable saving bat files and other file types for that matter.

[DSapseid]

If you use 2003 R2 its got it builtin file screens to stop saving certain file types.

[Embazzy]

Hi as a follow up to this we use a program on our file server called Spaceguard that does folder restrictions by extension and also sets folder size limits from what i can remember it was quite reasonably priced very simple to setup and does what it says on the tin we got it from PNL tools just google them

 

 

Embazzy

[FN-GM]

Hi as a follow up to this we use a program on our file server called Spaceguard that does folder restrictions by extension and also sets folder size limits from what i can remember it was quite reasonably priced very simple to setup and does what it says on the tin we got it from PNL tools just google them

 

 

Embazzy

 

You can do that with GPO.

 

I would block all .bat .cmd files apart from the path of your scripts.

[CyberNerd]

Kids have just discovered that they can write an msdos batch file containing just "command" to bypass the GPO restrictions on command prompt, does anyone know of a way (without disabling script access) that we can lock this down?

 

it may also help to remove user execute permissions from command.com

[Ric_]

Of course, thinking about it logically, can the little darlings do anything particularly bad when they get to the command prompt?

 

Make sure your file permissions are set right and that you have relevant GPOs to prevent access to anywhere that they shouldn't be.

 

It isn't just .bat files that will allow the command prompt to run. You also need to include .cmd, .vbs, .js and quite a few more. R2 file screens has a list of script types built in by default.