Restrict software installation

[eejit]

If you go to the user's software restrictions as described above set some path rules like these:

 

d:\ Path Disallowed

e:\ Path Disallowed

h:\ Path Disallowed

l:\ Path Disallowed

p:\ Path Disallowed

v:\ Path Disallowed

 

This allows users to access data etc from the blocked locations but EXEs can't be run. It works well for us. We do it at an OU level so we can be flexible for different levels of user.

 

This is the biggest mistakes in group policies as far as I'm concerned. You can't block exe's for subfolders. So for the examples above you would have to disallow

d:\*.exe

d:\*\*.exe

d:\*\*\*.exe

d:\*\*\*\*.exe

etc., for all the other drives too, and for any other extension that you'd like as well. Nightmare

[NetworkGeezer]

This is the biggest mistakes in group policies as far as I'm concerned. You can't block exe's for subfolders. So for the examples above you would have to disallow

d:\*.exe

d:\*\*.exe

d:\*\*\*.exe

d:\*\*\*\*.exe

etc., for all the other drives too, and for any other extension that you'd like as well. Nightmare

 

There are two methods of application blocking. Software restriction policies as mentioned above or Run/Don't Run specified Windows Applications in the Admin Templates section of the User part of the GPO.

 

This second method is reliant on filenames only and so changes in directory paths don't matter. It works well if your students are 'GUI centric'

 

It's also more forgiving when it comes to dependent exes for major programs such as in Microsoft Office.

 

The one flaw appears to have to be programs which have spaces in the filename.

[NetworkGeezer]

This is the biggest mistakes in group policies as far as I'm concerned. You can't block exe's for subfolders. So for the examples above you would have to disallow

d:\*.exe

d:\*\*.exe

d:\*\*\*.exe

d:\*\*\*\*.exe

etc., for all the other drives too, and for any other extension that you'd like as well. Nightmare

 

Actually looking at TechNet again if it's possible to specify a path as just *.vbs then you may be able to use d:*.exe which should cope with subfolders.