How can i stop users from running bat files from memory sticks

[gaz003]

We wish to use some design software by Prodesktop but to use this software I have to enable command prompt script processing. Although from the servers .bat files have being blocked students are able to logon the network and run these types of files from there pen drive potentially allowing them to get to command prompt and run all kinds of problems!

 

Does anyone know of a way through group policy where i can stop .bat files from being run on pen drives.

 

I would be graetful of the assistance as I need to install this software a.s.a.p

 

Regards

Gareth

[kili]

Your answer is here Post #19 of this thread explains how to do what you want using GPO's. I've implemented this and it works fine.

[morganw]

I do it in the same way with USBDLM and user based software restrictions policies. Important to remember that the number of driver letter you configure using USBDLM must be at least equal to the maximum number of USB ports that your computers have. If you've set up 3, then the 4th memory stick that is inserted will not be covered by restriction. Also watch out for built-in card readers using USBDLM drive letters.

[uwe-sieber]

I do it in the same way with USBDLM and user based software restrictions policies. Important to remember that the number of driver letter you configure using USBDLM must be at least equal to the maximum number of USB ports that your computers have. If you've set up 3, then the 4th memory stick that is inserted will not be covered by restriction. Also watch out for built-in card readers using USBDLM drive letters.

 

USBDLM can be configured to assign "no letter" too:

 

[DriveLetters]

Letters=X,Y,Z,-

 

This way the first three USB drives get letters X, Y and Z. Additional drives get no drive letter. Counting USB ports is not good enough beause one USB device can have multiple drives (as multislot cardreaders) or multiple partitions (USB harddrives). And the user could attach a USB hub...

 

Uwe Sieber

Edited November 15, 2010 by uwe-sieber

[mtillbrook]

the other thing to do of course being to block memory sticks!! I know of a few schools that have done this now as they were getting too many virus problems.

 

Quite a few places now have got halfway there and blocked them for pupils and allowed them for staff but supplied secure sticks for staff and only allowed those certain ones!

[featured_spectre]

@mtillbrook is right, blocking memory sticks would be the way to go, you can get small vents to cover over where they would slot in, or you can disconnect them from the motherboard. Either option works well

[box_l]

Hi Uwe, welcome to edugeek.

 

Lots of people using your software on this forum, me included.

 

Thanks for USBDLM, it has made thing so much easier.

 

BoX