I want to allow a specific program to run from USB

[kennysarmy]

Hi I have a "Prevent removable media source for any install" in place to prevent users from running executables from cd-roms, memory sticks and the like.

 

I wish to trial some 4GB USB 2.0 Hi-Speed DataTraveler Locker w/Encryption sticks but they look like they rely on the software running as an executable from the stick itself - which of course will get denied.

 

Is there a way to right a policy which will ALLOW just that ONE particular exe to run?

 

Cheers.

[Dageezah]

You can create a software restriction policy in your GPO. then disallow e:\*.* f:\*.* g:\*.* then allow e:\autorun.exe or whatever you need

[kennysarmy]

Thanks....

[ZeroHour]

Also with that you can create a signature of a file to authorise which means it has to be the correct program regardless of file name.

[kili]

You can create a software restriction policy in your GPO. then disallow e:\*.* f:\*.* g:\*.* then allow e:\autorun.exe or whatever you need

 

I did this using the hash file signature of Truecrypt portable although the exe was allowed to run I still hit the problem that the user needed admin rights to install the Truecrypt driver file.

 

I need some way to install the driver via a script to all my workstations prior to the user inserting their USB stick with Truecrypt portable.

 

Kili

[chazzy2501]

Am I right in thinking that you could use the software restriction policy to deny all exes on the usb drive (stopping all unwanted programs inc viruses) but then put a hash of the particular exe as an allow. The hash being more specific will override the general deny all.

 

the hash process is easy btw, whilst in gpedit just point to the exe and bam (over simplified). if you want the autorun to work you will have to specify that as well but it may leave you vunerable to viruses.

[kili]

Am I right in thinking that you could use the software restriction policy to deny all exes on the usb drive (stopping all unwanted programs inc viruses) but then put a hash of the particular exe as an allow. The hash being more specific will override the general deny all.

 

the hash process is easy btw, whilst in gpedit just point to the exe and bam (over simplified). if you want the autorun to work you will have to specify that as well but it may leave you vunerable to viruses.

 

Yes your right that's how it all works.

 

I don't see an autorun.inf file for Truecrypt traveller in the program files which is what where using but yes your also right we don't want autorun.inf available either

[ZeroHour]

Am I right in thinking that you could use the software restriction policy to deny all exes on the usb drive (stopping all unwanted programs inc viruses) but then put a hash of the particular exe as an allow. The hash being more specific will override the general deny all.

 

the hash process is easy btw, whilst in gpedit just point to the exe and bam (over simplified). if you want the autorun to work you will have to specify that as well but it may leave you vunerable to viruses.

 

Yeh you just tell the hash to be an allow (as you can hash denies too)

[kili]

Ah I see the autorun.inf file in the root of the usb stick. We have autorun blocked so no joy in that direction