stop .exe from home folders

[Aaron]

Hi everyone just looking to see how i could stop this.

 

I used another post on edugeek and it was great for stopping .exe files as well as others but i have found

that they can run from there my documents. I would like to be able to stop this from happening as well

and was wondering what others do.

[Dos_Box]

If you are using GPOs then simply add the location to the policy. Can you show us which post had the instructions you followed?

[JJonas]

I am also interested in doing this to stop students running\copying mp3 files to and from their memory sticks. I know it has something to do with Software Ristriction Policies but I have never set up a SRP before so a guide would be nice.

[Mr.Ben]

How about using file screens (available from 2003 R2). You can stop the saving/transferring of media and exe files onto your Network, then use GPO's to restrict which exe's can run.

[JJonas]

How about using file screens (available from 2003 R2). You can stop the saving/transferring of media and exe files onto your Network, then use GPO's to restrict which exe's can run.

 

We have 2003 R2 but it is not on all of our servers and not on the server with the students data.

[Aaron]

here is the post i followed and it seems to work fine for memory sticks.

 

http://www.edugeek.net/forums/windows/7041-stopping-exe-files-being-run-usb-stick.html

[ChrisH]

We have 2003 R2 but it is not on all of our servers and not on the server with the students data.

Might be worth the extra licence. The R2 stuff is just an addition so can be added on top of you normal Server install.

Software restriction policies wont work for stuff like MP23 etc. It has to be an executable type and even if you try and define it as one it still wont work. You want to use R2 file screens.

[JJonas]

The R2 stuff is just an addition so can be added on top of you normal Server install.

 

So we would not need to reinstall 2003 just add the additional stuff? Will the R2 stuff block MP3's on memory sticks? if so why cant I just set it up from the Server on my domain that has R2 on it already? An lastly is there a good guide to setting up file screens?

[ChrisH]

You can't use R2 on the memory sticks. That's why I use SRPs for executables etc, but I cant do anything with MP3s on them. You can lock it down as tight as you want on any normal file areas with the filter screen.

Setting up file screens is fairly easy. All you do is select a volume, select a category of files you want to block eg executables, Video/Music and apply it. You can edit the categories to remove/add restrictions on certain file types.

[JJonas]

So is there no way top stop students accessing MP3 files on memory sticks?

[ChrisH]

I would be happy to be corrected but without some other 3rd party app, I don't think so. May some AV software could be used to block em? Just guessing.

[aerospacemango]

What I've done is block off "D,E,F,G,H,I" drives from opening .exe files, so that Firefox Portable, or any other .exe cannot be run from a USB. I would imagine that putting C in there would stop that running from My Docs too??

 

Or have I got that wrong?????

[ChrisH]

You can use SRP to stop executables in the user areas as well. This is easy if you also map there redirected to a network drive as well so you can just stop h:\*.exe etc.

[Aaron]

thats what i wanted to ask because at the moment i have it just that the students can click on my documents and it is redirected to \\server-1\students\year\%username%\my documents but can i have this map to a network say N:\ and then do the same as what i have done for memory sticks?

[Aaron]

so when the user goes to my computer they can also get access to there my documents by click on the share as well as clicking on my documents under the start button?

[Aaron]

can anyone help with this issue i want to be able to create a drive that when the user clicks on my computer they can see there username which is actually there my documents this is so i can put restrictions on that drive to stop .exes being played. At the moment when a student logs in to get to their my documents they just double click on my documents and this is mapped using GPO to \\server\Studnets\Year\%username%\My Documents.

 

I want to be able that when a student logs in they can also see there my documents on a Drive letter which i can then put restrictions on is this possible with the current setup that i am already running?

[Aaron]

has anyone got any ideas on how i could fix this little issue?