Software Restriction Policy Issues

[notalot]

I’m currently stumped, we are running a windows 2003 environment and I’m currently trying to get game maker 7 working again.

 

We added a new software restriction policy to stop out students running files straight out of zips where we used %temp% and blocked the normal file types including exe files.

 

When you try and run your game game maker creates a exe file in %temp%\gm_ttt_(5 numbers)\filename.exe

 

So I’m trying to create a path rule that will allow the exe to run.

 

I have tried the following (one at a time);

 

%temp%\gm

%temp%\gm_ttt

%temp%\gm*

%temp%\gm*\*

%temp%\gm_ttt*

%temp%\gm_ttt_?????*

%temp%\gm_ttt_?????\

%temp%\gm_ttt_?????\*

%temp%\gm_ttt_?????\*.exe

 

I have been using the same policy that blocks the %temp% folder and removing the policy allows the program to work without any problem.

 

The policy is being applyed, when looking in RSOP and it is still blocking the running of files from zips.

 

Can anyone see what I’m doing wrong? Or suggest a better way of stopping students running files straight out of a zip without extracting them.

[rvdmast]

Disable explorer's built-in ZIP support.

Then install Uniextract ( Universal Extractor | LegRoom.net ) which only lets you extract files

from the context-menu, not open them.

Also, it support almost any compression format, not just ZIP.

[notalot]

thanks Rvdmast, any other thoughts?

[notalot]

Cracked it, not sure why it doesnt like the %temp% we tryed, but if we used C:\Documents and Settings\%username%\Local Settings\Temp\gm_ttt_????? then it worked.

 

we also have added 2 more rules just in case there is a old profile in there

 

c:\documents and settings\%username%.(Domain)\local settings\temp\gm_ttt_*

c:\documents and settings\%username%.(Domain).???\local settings\temp\gm_ttt_*

Edited April 26, 2010 by notalot

[darrenstraight]

Thanks this solved the same problem I have which I was about to post after having no luck in the RM CC4 Communites Forum.

 

I allowed the following path:

%UserProfile%\Local Settings\Temp\gm_ttt_?????\*

 

My Problem incase anyone else on the internet searches for this problem too:

This is a long shot here. We are having an issue at the moment on Windows XP where if we alow .exe files to be run for example at "C:\Documents and Settings\test.pupil\Local Settings\Temp\" with allow path rule "UserProfile%\Local Settings\Temp\*" for GameMaker testing/debuuging. Then users can open up .zip files on the internet (instead of using save button) and execute/install .exe contained within this folder.

 

Process gamemaker does when testing/debuging a game:

 

1. User loads up gamemaker and creates a room etc.

2. User then presses the green/red triangle to either test/debug the game.

3. Gamemaker stores the test .exe file in a folder such as C:\Documents and Settings\test.pupil\Local Settings\Temp\gm_ttt_43426\game.exe

4. User plays and closes game

5. Gamemaker now deletes tempory file/folder.

 

 

Process you can use to open up and install executables:

 

1. User goes to YoYo Games

2. User says open instead of save when promted what to do.

3. User will now have a windows open such as C:\Documents and Settings\test.pupil\Local Settings\Temporary Internet Files\Content.IE5\J07C26NW\gmaker80[1].zip

4. User opens up gmaker80.exe

5. The .exe file will copy it's self for example to C:\Documents and Settings\test.pupil\Local Settings\Temp\Temporary Directory 1 for gmaker80[1].zip

6. The Gamemaker installer will now launch and can be installed.

 

As you can see if I allow gamemaker to run .exe in the temp folder it also alows .exe to be opened up from a zip folder on the internet.

 

The only solution I have found is that each time a user wants to test their game that it's stored in the "N:\Game Maker" foldder where .exe are allowed to be run (only game maker class know of this location), however this means you have to create the .exe file each time you want to test the game and you will not be able to use the green/red traingle to test/debug the game.

 

You cant have an allow path for "C:\Documents and Settings\test.pupil\Local Settings\Temp\C:\Documents and Settings\test.pupil\Local Settings\Temp\gm_ttt_43426\game.exe" becuase game maker creates a diffrent directory name each time for example gm_ttt_13427 gm_ttt_63426 etc..

 

Any solutions would be of great help. I'm just wondering how long it will be until users start oepning up other .zip file on the internet an install the .exe files inside them. I wish there was a way I didnt have to allow the %UserProfile%\Local Settings\Temp path (Files run from compressed folders are unzipped to this directory and run from here - potentially circumventing Software Restrictions.) to allow gamemaker to test/debug games. Doesnt seem to be any regedit path to change where gamemaker puts the temp game.exe.

 

The only other thing I could think of is changing the environment variables %TEMP% and %TMP% for the users who do need gamemaker and allowing that path but that doesnt really solve the problem either.