Banning exes on USB drives

[cookie_monster]

I've had a read through a few threads on here about banning exes on USB drives and most seem to come to the conclusion that you can ban exes in subfolders even using wildcards. From my testing this does seem to be the case, the only wildcard that works is *.exe which bans them from running exes for anywhere. This works so well that they can't logon so I would have to allow certain areas.

 

Has anyone come up with a workable way to do this or is a whitelist the only way to go without third party software?

 

http://www.edugeek.net/forums/windows/7041-stopping-exe-files-being-run-usb-stick.html

 

Thanks.

 

 

EDIT

 

Oh hang on I've just found this anyone tried it? I'm going to give it a try now.

 

http://www.beyondlogic.org/solutions/trust-no-exe/trust-no-exe.htm

 

 

Well it looks pretty good but unfortunatly there's no way to seperate staff and students so I don't think we can use it

Edited October 23, 2009 by cookie_monster

[OutToLunch]

Running trustnoexe on our standalones here with no problems, haven't tried it in a domain environment. Could you not just disable the app/service when staff log on? (login script)

[cookie_monster]

Could you not just disable the app/service when staff log on? (login script)

 

Does it run as a Windows service? If so then no as our staff don't have rights to dissable services.

[OutToLunch]

Can't check easily, sorry - it's running on standalones on one of our residential units offsite, I think it's only launched on login though, so one way or another you ought to be able to stop it from initialising for a specific user group.

[cookie_monster]

Ok i'll take a another look.

[GoldenWonder]

We use Software restriction policies here. Using a whitelist basically won't allow any executable unless it is one we know about.

 

Sometimes its a pain as staff are forever bringing in some pointless flash animation on a USB pen which is blocked, but we have 'safe' areas to copy these too so they can try them out.

 

You have to have a good idea of software in use on your network, but you can bypass a lot by allowing know pathnames (ie C:\Program Files etc)

[cookie_monster]

I enabled a whitelist the other day to test and users couldn't logon anymore probably due to something launching in the logon script I need to look into it.

 

Can you share a bit more detail about what you allow/deny to get started? No rush

 

Thanks.

[GoldenWonder]

You have to allow:

 

Sysvol and Netlogon shares (I used wildcard i.e \\Server?\sysvol) which covers Server1,Server2 etc

C:\windows and c:\windows\system (defaults to allow these anyway)

 

We allow c:\program files by default as only admins can install software

 

Everything else in our list is simply executables\applications etc that are on server shares. Along with a few batch files users run on login.

 

One peculiarity was in desktop and start menu redirection - we had to allow the source of the desktop/start menu as well as the targets for the applications listed.

 

Works well now. In that the users don't like the fact they can't just run any old rubbish that someone gave them on a usb pen

[cookie_monster]

Sometimes its a pain as staff are forever bringing in some pointless flash animation on a USB pen which is blocked, but we have 'safe' areas to copy these too so they can try them out.

 

I was thinking of just doing this for students anyway to start.

 

Cheers.

[cookie_monster]

You have to allow:

 

Sysvol and Netlogon shares (I used wildcard i.e \\Server?\sysvol) which covers Server1,Server2 etc

C:\windows and c:\windows\system (defaults to allow these anyway)

 

We allow c:\program files by default as only admins can install software

 

Everything else in our list is simply executables\applications etc that are on server shares. Along with a few batch files users run on login.

 

One peculiarity was in desktop and start menu redirection - we had to allow the source of the desktop/start menu as well as the targets for the applications listed.

 

Works well now. In that the users don't like the fact they can't just run any old rubbish that someone gave them on a usb pen

 

 

 

Does this give you issues with web sites ever? I'm thinking back to some intranet software a while back that downloaded an exe to temp but wouldn't run due to software restriction policy.

[Stuart_C]

I use the User Defined Rules in McAfee's AV software (Via the Policy server). Allows me to stop MSI, BAT's, CMD, MP3, etc etc from just about anywhere I want (which is USB drives, desktop's, home drives). It's not fool proof but it certainly fools the majority.