GPO - Only allow programs in C:\program files to run

[Dominic]

I have a problem where students are running firefox and other browsers from there network drive and USB drive. Is there a way to only allow programs in C:\program files to run.

[matt40k]

Yes, Software Restriction Policy.

[AngryTechnician]

Bear in mind you will need to allow more locations than just Program Files. Just off the top of my head, Notepad, Calculator, and Paint are in the Windows system directory (not to mention all the system executables in various locations).

[cookie_monster]

We use a software restriction whitelist for students it's a user GPO so it's quite easy to setup and test on an OU that won't affect all users to start with. Below is a few exclusions that you will need, I can post you our full list when I get change. This kills exes on USB dead

 

%AllUsersProfile%\Desktop\ Path Unrestricted

%AllUsersProfile%\Start Menu\ Path Unrestricted

%AppData% Path Unrestricted

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% Path Unrestricted

%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur rentVersion\ProgramFilesDir% Path Unrestricted

%SystemRoot%\System32\nvcplui.exe Path Disallowed

%SystemRoot%\System32\runas.exe Path Disallowed

%UserProfile%\Desktop\ Path Unrestricted

%UserProfile%\Local Settings\Temp\ Path Disallowed

%UserProfile%\Start Menu\ Path Unrestricted

*.mdb Path Unrestricted