how do you stop kids from running exe from IE.

[timbo343]

Hey

 

Kids have found out how to run exe files from the net, when it askes to either run, save or cancel the kids click run and the exe runs. Is there anyway to stop this from happening, or does anyone know where the exe file temporarly downloads to?

 

Thanks

 

tim

[Dos_Box]

There is a GPO to stop this.

[CyberNerd]

or block it at the proxy level

[timbo343]

ok, do you know where in GPO you can configure this?

[Irazmus]

Implement Software Restriction Policies

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=5511&highlight=software+restriction

[timbo343]

yeah i knew about, but do you know where the temporary file runs from when it is downloaded?

[Irazmus]

I believe it's C:\Documents and Settings\%USERNAME%\Local Settings\Temp although if I'm sure someone will correct me if I'm wrong ^^

[CyberNerd]

But why let them download the exe in the first place only to then ban the file from being run? sounds backwards to me.

[ZeroHour]

I believe it's C:\Documents and Settings\%USERNAME%\Local Settings\Temp although if I'm sure someone will correct me if I'm wrong ^^

Nape not there, IE based "run" actions are in C:\Documents and Settings\%USERNAME%\Local Settings\Temporary Internet Files\ but block BOTH as both are holes.

[Irazmus]

I believe it's C:\Documents and Settings\%USERNAME%\Local Settings\Temp although if I'm sure someone will correct me if I'm wrong ^^

Nape not there, IE based "run" actions are in C:\Documents and Settings\%USERNAME%\Local Settings\Temporary Internet Files\ but block BOTH as both are holes.

 

D'oh, of course it is ^^;

[MkII]

But why let them download the exe in the first place only to then ban the file from being run? sounds backwards to me.

AFAIK you can't block exe's specifically - just everything - and some things we need - pdfs etc.

 

Also... We found out recently that Dance eJay uses the temp folder for the program to run!

[ZeroHour]

yeh I find the odd exe do extracts to the temp folder. Just hash rule the files

[CyberNerd]

But why let them download the exe in the first place only to then ban the file from being run? sounds backwards to me.

AFAIK you can't block exe's specifically - just everything - and some things we need - pdfs etc.

 

Also... We found out recently that Dance eJay uses the temp folder for the program to run!

 

I guess it depends what proxy filtering you use, we can block specific extensions with dansguardian and I suspect most other decent filtering proxies will do the same

[timbo343]

yeah, we are running websense but there are some of the sites that arent in websense's definition files so you either have to add them your self or creat rules in GPO

[Geoff]

Yep, Dansguardian here too. You can block by file extension, mime type, url, or hostname.

[mac_shinobi]

R2 has capability to block by file extension ie exe, mp3, wma etc etc.