software restriction policies path rule

[Dominic]

I want to use software restriction policies path rule to block .exe running from the desktop, usb drives and network areas. What paths do I need to use for this to work.

[Gatt]

there are different ways to block .exe's

 

bad_file.exe -> blocks all instances of "bad_file.exe" running in any location

path\to\file\*.exe -> blocks all exe files in the specified path (but doesn't drill down sub-folders IIRC) (eg: P:\folder\*.exe or \\server\share\folder\*.exe)

%userprofile%\desktop\*.exe --> will block all exe's from running in the users desktop

\\server\share\folder -> blocks everything lilsted in "Designated File Types" from that location

 

USB drives are slightly more tricky as you cannot control the file structure so if you blocked \*.exe - it would only block exes in the root folder - not the sub folders

Also, unless you have USBDLM - then the USB Drive letters may vary!

 

Would also recommend blocking via a hash rule - otherwise all they need to do is move the file or rename the file from "bad_file.exe" to "good_file.exe" to get round SRP

Edited March 22, 2010 by Gatt

[Dominic]

there are different ways to block .exe's

 

bad_file.exe -> blocks all instances of "bad_file.exe" running in any location

path\to\file\*.exe -> blocks all exe files in the specified path (but doesn't drill down sub-folders IIRC) (eg: P:\folder\*.exe or \\server\share\folder\*.exe)

%userprofile%\desktop\*.exe --> will block all exe's from running in the users desktop

\\server\share\folder -> blocks everything lilsted in "Designated File Types" from that location

 

USB drives are slightly more tricky as you cannot control the file structure so if you blocked \*.exe - it would only block exes in the root folder - not the sub folders

Also, unless you have USBDLM - then the USB Drive letters may vary!

 

Would also recommend blocking via a hash rule - otherwise all they need to do is move the file or rename the file from "bad_file.exe" to "good_file.exe" to get round SRP

Is it possiable to block .exe from running from a folder on the desktop.

[Gatt]

yes - so long as you know what that folder name is and that the name wont change

 

So %userprofile%\desktop\folder\badfile.exe - would work

BUT - if the user renames "folder" to "renamed" then the SRP will fail as it is looking for the path above..

[Dominic]

I don't know the name of the folder. Can a wild card be used.

[Gatt]

Not sure - been googling for that one but not seen any reference to wildcards other than for the filename...