Blocking certain file extensions

[bart21]

Hi

 

I am after a way of blocking certain file extensions from running from the users h: drive (redirected my documents).

 

inperticular .mht files!

 

is there a way to do this via Group Policy?

 

thanks

[bart21]

wont that block the whole of the h drive?

[6Foot2]

I have just tried what has been suggested above and I can't get it to work [students can still run Sol.EXE in their home folder [u:]

 

I would love to crack this: Been trying to get it right for ages!

[tmcd35]

If I remember rightly you need to add additional rules for the file types you want to block, such as

 

H:\*.exe

 

Either that or create a hash for Sol.exe and then create a hash rule to block that particular program.

[6Foot2]

I have just tried the additional rule route [u:\*.exe]

 

That did not work.

 

I am now trying the hash route [waiting for the policy to replicate before restating the station and logging a test student on again...]

 

Edit: Success! Thanks. Now all I have to do is block all of the programs that I don't want them to run from U:, E:, and F:

 

Edit: And I need to find how to prevent ALL EXEs from running from U:, E:, and F:

Edited October 13, 2010 by 6Foot2
Add detail to the post. Resolved?

[detjo]

And I need to find how to prevent ALL EXEs from running from U:, E:, and F:

Does FSRM offer anything?

[themightymrp]

If your server is running Windows 2008 you can add on the File Server resource manager and then use the File Screening Management section to prevent users saving particular file types to the drives such as .exe .com .cmd etc. Once they can't save that kind of file to their area all you need to do is a find and delete procedure to remove the current ones.

[IanT]

Im surprised no one has suggested File Server Resource Manager, I use this and works a treat!

[Guest Guest]

2003 R2 has file screening too

[6Foot2]

Does FSRM offer anything?

 

I have just had a look at the server and FSRM was already installed [i hadn't noticed it]

 

I have just configured the 'Block Executables' for students and I have also told the sever to send me a report on executables and duplicate files. Thinking about it now perhaps the duplicate files report was not such a good idea but it is done now so I will wait and see what comes through.

 

Edit: I have got FSRM working. I also have E-Mail alerts when a student tries to save an executable to their MyWork on the network.

 

Now all I have to do is put similar blocks in place for USB memory sticks. Back to Group Policy/Hash Rules?

Edited October 14, 2010 by 6Foot2
Add detail to the post.