eric.777 Posted February 16, 2011 Posted February 16, 2011 Hi All, Want to stop bat files and other exe from student home drivers. Any one know the net work path and commands for this. Student home drives are map to \\server2\users$ on H. So i put in H:\*.bat or \\server2\users$\*.bat. Would like to do screening but server 2 is old win2000 server. So tryiug hash rules. Still no joy... Any help please.
pholding Posted February 16, 2011 Posted February 16, 2011 Have you tried path rules: GPO: User Configuration > Windows Settings > Security Settings > Softwrae Restriction Policies > Additional Rules Add a new path rule \\server2\users$ Disallowed We also add the profile path \\server2\profiles$ Disallowed. We also restrict removable media by drive letter, so we would also have a path rule for F:\, D:\ and any other drives that you feel necessary.
steve Posted February 16, 2011 Posted February 16, 2011 If you are running 2003R2 or above you could also do this with File Services Resource Management (FSRM). Install the role on the server with the share and create a file screen for the types of file you want to block.
eric.777 Posted February 18, 2011 Author Posted February 18, 2011 Hi, GPO: User Configuration > Windows Settings > Security Settings > Softwrae Restriction Policies > Additional Rules Add a new path rule \\server2\users$ Disallowed We also add the profile path \\server2\profiles$ Disallowed. just looked at the GPO results for the students pc and it says Policy Setting Interactive logon: Number of previous logons to cache (in case domain controller is not available) 0 logons Software Restriction Policieshide Enforcement Policy Setting Apply software restriction policies to All software files except libraries (such as DLLs) Apply software restriction policies to the following users All users Designated File Types File Extension File Type ADE Microsoft Office Access Project Extension ADP Microsoft Office Access Project BAS BAS File BAT MS-DOS Batch File CHM Compiled HTML Help file CMD Windows NT Command Script COM MS-DOS Application CPL Control Panel extension CRT Security Certificate EXE Application HLP Help File HTA HTML Application INF Setup Information INS Internet Communication Settings ISP Internet Communication Settings LNK Shortcut MDB Microsoft Office Access Application MDE Microsoft Office Access MDE Database MSC Microsoft Common Console Document MSI Windows Installer Package MSP Windows Installer Patch MST MST File OCX ActiveX Control PCD PCD File PIF Shortcut to MS-DOS Program REG Registration Entries SCR SCR File SHS Scrap object URL Internet Shortcut VB VB File WSC Windows Script Component Trusted Publishers Allow the following users to select trusted publishers End users Before trusting a publisher, check the following to determine if the certificate is revoked None Software Restriction Policies/Security Levelshide Policy Setting Default Security Level Unrestricted Software Restriction Policies/Additional Ruleshide Hash Ruleshide LOGON.BAT; 5 KB; 27/05/2009 12:56:15 File hash 2FE2D2B3483A7C121F8A824CC9824F3C:4417:32771 Security level Unrestricted Description Date last modified 16/02/2011 11:10:24 Path Ruleshide %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot% Security Level Unrestricted Description Date last modified 15/02/2011 16:23:27 %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%*.exe Security Level Unrestricted Description Date last modified 15/02/2011 16:23:27 %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRoot%System32\*.exe Security Level Unrestricted Description Date last modified 15/02/2011 16:23:27 %HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir% Security Level Unrestricted Description Date last modified 15/02/2011 16:23:27 H:\ bat Security Level Disallowed Description Date last modified 17/02/2011 12:45:46 H:\ exe Security Level Disallowed Description Date last modified 17/02/2011 12:45:52 H:\*.exe Security Level Disallowed Description Date last modified 15/02/2011 16:58:10 H:\*.exe Security Level Disallowed Description Date last modified 16/02/2011 13:09:21 H:\*bat Security Level Disallowed Description Date last modified 16/02/2011 11:07:06 H:\cmd Security Level Disallowed Description Date last modified 17/02/2011 12:46:28 logon.bat Security Level Unrestricted Description Date last modified 16/02/2011 10:52:11 But the student just rename the bat file and run it Example is open word then put a scrip command in it then save it as a plane text . word will then let you save it as a hack.BAT in the home drives Then run it. How can we stop them when we use Logon.bat to map printers and map drives? Any help please....
jamesb Posted February 18, 2011 Posted February 18, 2011 Could you look at changing logon.bat to be a vbs script instead, and just ban batch files across the board?
eric.777 Posted February 18, 2011 Author Posted February 18, 2011 Hi, Thanks for the responce but we should be able to stop *.Bat *.EXE *.CMD from a net work drive with GPO? Just to let you know if i use *.bat with no( H:\*.bat ) it works but no mapping drives or printers..
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now