Preventing Bat and vbs files

[BSOD]

Hi

 

Got a problem where our darling students keep creating bat and vbs files and saving them to their home directory. Is there a way bat and vbs files could get automatically deleted on some sort of scheduled scan. Or some other way to prevent these files from being saved in the first place?

[tommccann]

try EduSweep

[mac_shinobi]

for bat /vbs you could use group policy to do a black list to not allow command.com , wscript, cscript but not sure how that would effect startup / logon scripts ??

[maniac]

Hi

 

Got a problem where our darling students keep creating bat and vbs files and saving them to their home directory. Is there a way bat and vbs files could get automatically deleted on some sort of scheduled scan. Or some other way to prevent these files from being saved in the first place?

 

If you have Server 2003 R2 you can setup Storage Recource Manager to stop the students saving certain extensions in their home areas - we do that here with great success. You can also block Wscript and command, it doesn't seem to affect login scripts for us.

 

Mike.

[sted]

for bat /vbs you could use group policy to do a black list to not allow command.com , wscript, cscript but not sure how that would effect startup / logon scripts ??

 

cant you block them running from certain locations (so say d/e/f/u assuming u = users area d/e/f are cd/pen)

[mac_shinobi]

If you have Server 2003 R2 you can setup Storage Recource Manager to stop the students saving certain extensions in their home areas - we do that here with great success. You can also block Wscript and command, it doesn't seem to affect login scripts for us.

 

Mike.

 

I was thinking about that but I couldnt recall what it was called nor how to set it up so didn't want to suggest that.

[mullet_man]

We use the Software Restriction Policy, to disallow

 

*.bat

*.cmd

etc

 

but need to allow \\server\netlogon\*.bat

etc

 

so logon scripts run.

[mac_shinobi]

We use the Software Restriction Policy, to disallow

 

*.bat

*.cmd

etc

 

but need to allow \\server\netlogon\*.bat

etc

 

so logon scripts run.

 

Would that be a point of failure because if they can get to the sysvol / netlogon or where ever ( depending on permissions of course ) they may be able to run scripts from there ?