Running an application over a DFS share

[GoldenWonder]

I've got a DFS domain based share that merges a load of server shares into one common share (i.e \\domain.com\share) and users have a drive letter mapped to that share. I've done this because we use a whitelist Software Restriction policy and the list of shares was making the policy rather large! All of the seperate shares are integrated into the DFS share so I only have to unblock that pathname.

 

Problem is, now when users run the application (pathname is using the DFS share drive letter) it runs OK, but they get the 'Publisher could not be verified' Security warning where you have to click Run or Cancel ('This file does not have a valid digital signature etc')

 

I've set the group policy to allow apps to run on the Intranet zone but it still happens. is there anything else I can do to stop this message appearing when running an application across a dfs share?

[carvjo]

Looks like you have done what I've seen suggested:

 

Group Policies: User Configuration - Administrative Templates - Windows Components - Attachment

Manager

 

Add "*.exe" to the "Inclusion list for **moderate** risk file types" setting.

 

I've also seen this suggested:

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations]

"LowRiskFileTypes"=".exe

[GoldenWonder]

Hmm, I haven't changed the Attachment management in any policies.

 

After a little tinkering I've changed the group policy settings that Automatically detect intranet and also manually added the domain name into the Intranet Zones (sites to zones assignment list) and it seems to have worked.

 

Odd behaviour as the problem didn't occur when running the apps from the original shares (which they effectively still are!)

[PiqueABoo]

That makes sense to me. To fix that or something similar (it's been a while) I've long been throwing these straight into the Trusted Zone: servername (NetBIOS), servername.example.com, *.example.com. In principle the second one is redundant because of the third one which I'm fairly sure I added for DFS shares (that wildcard does, or at least did, cover "\\example.com\..").

 

One of those "seems to work, I'll go back test it properly and then do it with more finesse, on a rainy day" things.

[YPS_Net_Admin]

Thanks for the info Carvjo, was a snap to deploy via ZenWorks and GPO settings. Now I can freely run .bat files for software installations, registry changes, etc.