Stopping .exe files from being run from a USB stick

[Kyle]

I think this has been covered many times but i can't seem to find older posts when i search,

 

Is there a way to stop kids from running exe files from the usb keys they bring into school? We don't want to ban them altogether but wondered if there is away to stop this.

 

Sorry if this has been answered before but i can't find it.

[Ric_]

A quick forum search using "executables" and "usb" as the keywords (make sure you check the 'all' box) turns up a few

[Kyle]

Not for me it dont :-(

[Geoff]

This Google query results in some interesting threads, such as:

 

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=6599

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=2175

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&p=43905

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&p=9711

[rrichmond]

Preventing students running exe, cmd and bat files from their usb drive

 

Note: The following information has been taken from http://www.kenji-d.com/technet/ and modified to suit our school situation.

 

To do this you need to modify the Local Security Settings.

 

1. From the start menu, go to the RUN command window and enter secpol.msc

2. In the Local Security Settings window, select Software Restrictions Policies, you’ll notice on the right pane that there are no policies defined.

3. To create a policy, select Action from the toolbar, then select Create New Policies.

4. Once a policy is created, you’ll notice 5 new objects in the right pane.

5. Select the Additional Rules Folder, right click and select New Path Rule.

6. A New Path Rule window appears. Here enter the path of the drive or folder you’d like to enforce restrictions on. After entering a path, make sure the Security level option is set to disallow.

7. Do this on all drives you wish to prevent this type of action on. For example A:\ D:\ E:\ F:\

8.Create a rule to prevent the user running executables in their home drive or the desktop. (We provide students with a mapped network drive H:\ Where they can be monitored from. They can run what they want from this drive.)

 

a) C:\Documents and Settings\COMMON PART OF STUDENT CODE

OR

b) “%UserProfile%” matches C:\Documents and Settings\ and all subfolders under this directory.

 

(Note: From : http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch06.mspx

Using Wildcards in Path Rules

 

A path rule can incorporate the "?" and "*" wildcards. The following examples show wildcards that are applied to different path rules:

* \\DC – ??\login$ matches \\DC – 01\login$, \\DC – 02\login$, and so on.

* \Windows matches C:\Windows, D:\Windows, E:\Windows, and all subfolders under each directory.

* C:\win* matches C:\winnt, C:\windows, C:\windir, and all subfolders under each directory.

* .vbs matches any application that has this extension in Windows XP Professional.

* C:\Application Files\*.* matches all application files in the specific subdirectory. )

 

9.Once the Paths are entered, the next thing to do is to set the enforcement properties. Select Software Restriction Policies and from the right side select Enforcement. There are two options:

 

a) All software files except libraries (such as DLLs) and All Software (Best to select this).

b) All users except local Administrators.

 

It is recommend you leave it as All software files except Libraries. If you select All software files instead, the thumbdrives will NOT be recognized and installed. This may be a good idea if you want to disable access to USB thumbdrives all together.

 

The second option is pretty straightforward, restrict everyone except local administrators or else you’ll be locked out too!

 

10.Next we go to the Designated File Types values, here we can specify which file extensions to restrict. This window permits you to add or delete file extensions to your need. Delete all except for: BAT, CMD, COM,EXE, REG, and VB. If there are other extentions you ned to add add themin the file extention box and click add. An example maybe for flash files?

 

You have now completed the task. Test it as neccessary before deploying,

You will then need to distribute this as per your situation.

[SpuffMonkey]

If you've the cash - you could buy DiskNet Pro - it does this and loads of other stuff besides.

[MkII]

To allocate specific drive letters to USB Devices use USBDLM (Drive Letter Manager)

 

Do as rrichmond says only using GPMC on the site (computer group/ OU) rather than the individual machine.

 

It's not sufficient to just block the root of the drive, you have to specify subfolders too.

 

I'd recommend you check the other linked threads for the full lowdown.

[rrichmond]

It's not sufficient to just block the root of the drive, you have to specify subfolders too.

 

Actually, If you do it the way I suggested, It does ANY folder on the drive in question, not just the root of the drive. I tried this out before publishing the information.

 

From: http://www.microsoft.com/technet/security/prodtech/windowsxp/secwinxp/xpsgch06.mspx

 

The Path Rule

 

A path rule specifies either a folder or a fully qualified path to a program. When a path rule specifies a folder, it matches any program that is contained in that folder and any programs that are contained in subfolders of that folder. Path rules support both local and UNC paths.

[MkII]

Well that's interesting then, and contrary to what's been said on here several times, unless I read it incorrectly.

[rrichmond]

Yes.. I Noticed that. Forgot to put it in my original post though

[peterk]

cheers m8 just tried your answer and it works a treat - I also work in a school and the only thing I can see is that if 2 devices are connected then the rule will have to be duplicated onto that 2nd drive letter - going through GP should be easy enough to apply to different drive letters

 

thanks again

[ajap99]

I have Set up software restriction policy ok to stop exes from running from USBs and a drive

Now I want to stop the students from running exes from their Mydocument folder

Their folder is on h drive

Was is the exact path to type into the rule

[rhyds]

I think you can use the %homeshare%%homepath% variables to specify mydocs, but I'm not sure of the syntax.

[ajap99]

Thanks rhyds in rrichmonds post 6 above part 8 is what i need but I would need the syntax clarified

[mark100]

Thanks rrichmond, that works a treat. no more firefox portable here

[chazzy2501]

I don't understand why your network hasn't been owned by now. The only safe thing to do is disable USB ports altogether, that and the CD drives and floppies (if you still have them).

 

bypasses used before I gave up...

 

bootable ISO USB and CD (bios config)

copy the exe to own / shared folder.

renaming exes to word.exe etc

autorun (broken in M$ even when it's disabled it's really not)

malformed .WMF and any other DOC, PPT file that contains a virus for your unpatched PC.

 

 

 

and I'm sure many more.

 

The only ultimatum I've ever issued was on USB drives. I now force all students to email files in those that can't have to come to me directly. (and they soon died off)

 

We'll soon have a VLe in place that should eliminate this need altogether! (phew)

[thomaswp]

Wish I had found this site/thread *before* writing a little script to watch over processes...

 

I'll play with this method of blocking exe from USB stick, but my solution may interest someone so here it is:

 

I wrote a vb script that is compiled to exe;

On boot the PC copies this exe to the c: drive (which is hidden from the pupils);

On pupil log in the exe is executed and loads the script in to memory;

The script checks every 15 seconds for a process with a path that is NOT on the c: drive and NOT in (a rather cludgy OR statement that creates) a whitelist;

If it finds the process, it logs who, what, when and which machine to a network folder and emails me the same information after it has quietly canned the process.

 

The kids think their software doesn't work (though there are usually two or three tries!) and I know who is fooling around. I usually rename the exe file to something without deleting it so that they can see that I am on top of things.

 

It has been running for a week now and I have trapped three kids so far.

 

Weaknesses:

They have to have write access to the network share (which is hidden) so if they found it they could delete those records;

If they are clever and work out what is going on they could write a script to disable my script but they would inevitably inform me of what they were doing as they did that unless they were *really* good. This is why I like the system here that shuts down all exes.

 

If anyone is interested in the script reply here and I will post it.

[john]

Yes please share away the more ways and suggestions of combating this the better for us please

[OverWorked]

I've just cracked it with a combination of USBDLM to lock USB drives to drive letters, and a Software Restriction Policy to stop executables.

 

Install USBDLM with the .msi and GPO and another .msi to deploy the .ini file with USBDLM's drive letters.

 

Set a GPO with a Software Restriction Policy for pupils. Leave everything at the defaults and add additional rules to disallow %homeshare%, %homepath%, H:\ (their home drive, but this may be the same as %homepath%), then the USBDLM drive letters: U:\, W:\ etc.

 

Don't set paths like U:\*.bat. It doesn't work like that. Disallowing U:\*.bat will only block .bat file on the root of U: and nothing else. Pretty useless. Just set paths like U:\ and it will block all file types listed in the Designated File Types in all subfolders.

Edited March 19, 2010 by OverWorked
spelling

[john]

oooh thats a way i didn't think of doing it!! We already have USB Drives set to use 4 letters..... Cheers

[thomaswp]

Yes please share away the more ways and suggestions of combating this the better for us please

 

Here you are: Things you need to change in <<>>.

 

I am no Bill Gates but it does the job. I compile it to exe using VbsEdit. This does NOT stop it running as a WScript process however, it just makes it harder for them to find the source. I have been pondering rewriting it in C++ but I would need to learn it first Or AutoIT, or doing what is described in this thread as a first line of defence!

 

' Forbidden process tracker
' Thomas W-P
' First code based on
' Process.vbs
' Free Sample VBScript to discover which processes are running
' Author Guy Thomas http://computerperformance.co.uk/
' -------------------------------------------------------'
'
'Command line Arguments:
'0 - the path to the log file
'1 - the wait time in seconds
'2 - debugging (1 = true, anything else = false)

Option Explicit
Dim objWMIService, objProcess, colProcess, objFSO, objLogFile, wshNetwork
Dim strComputer, strList, strNameOfUser, Return, strPathToLog, strComputerName, iWaitTimeSeconds
Dim debugging, argu, dbStr

'constants can't be changed by code
Const ForAppending = 8 'for the log save
Const tryEmail = true

'default values that can be overridden by arguments
strPathToLog = "<<>>" 'default argument 0
iWaitTimeSeconds = 15 'default time = argument 1
debugging = false 'argument 3

'does the command line switch on debugging?
If Wscript.Arguments.Count > 2 Then
	If Wscript.Arguments(2) = "1" Then debugging = True
End If

If debugging Then
	dbStr = "Arguments found are:" & vbCrLf
	For Each argu In Wscript.Arguments
		dbStr = dbStr & argu & vbCrLf
	Next
	GoDebug dbStr
End if

'set up variables
Set wshNetwork = WScript.CreateObject( "WScript.Network" )
strComputerName = wshNetwork.ComputerName
Set wshNetwork = Nothing

'initialise the object that will let us write a log file
Set objFSO = CreateObject("Scripting.FileSystemObject")

'check and load the arguments
If Wscript.Arguments.Count > 0 then
	If  objFSO.FolderExists(Wscript.Arguments(0)) And Not Wscript.Arguments(0) = "null" Then
		strPathToLog = Wscript.Arguments(0)
	End If
End If
If Right(strPathToLog, 1) <> "\" Then strPathToLog = strPathToLog & "\"

'check if there is a second argument setting the seconds to wait
If Wscript.Arguments.Count > 1 then
	If IsNumeric(Wscript.Arguments(1)) And Not Wscript.Arguments(1) = "null" Then iWaitTimeSeconds = Int(Wscript.Arguments(1))
End If

'debug what we have found so far
GoDebug("Log: " & strPathToLog & strComputerName _
    & ".csv" & vbCrLf & "Wait time: " & iWaitTimeSeconds & " seconds")


'prepare to get the list of processes
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
strComputer = "."

Do
	'get the list of services
	Set colProcess = objWMIService.ExecQuery ("Select * from Win32_Process")
	'run through processes checking the path
	For Each objProcess in colProcess
		   'if the path does not start with c, then get the user and write to file
	       If LCase(Left(objProcess.ExecutablePath,1)) <> "c" _ 
	       		And objProcess.ExecutablePath <> "<<>>" Then 
	               Return = objProcess.GetOwner(strNameOfUser)
	               If Return <> 0 Then
	                       strNameOfUser = "unknown"
	               End If
	       		   GoDebug("strNameOfUser: " & strNameOfUser & _
	       		   		":  Will try to kill " & objProcess.ExecutablePath)
	               'send an email?
	               If tryEmail Then SendEmail strNameOfUser, objProcess.ExecutablePath, strComputerName
	               'write to the file
	               Set objLogFile = objFSO.OpenTextFile(strPathToLog & strNameOfUser _
	               		   & ".csv", ForAppending, True)
	               objLogFile.Write strNameOfUser & ", " & strComputerName & ", " & objProcess.ExecutablePath _
	                       & ", " & FormatDateTime(now(),0) 'name, file, date/time
	               objLogFile.writeline
	               objLogFile.Close 'ensure it is closed and forgotten
	               'kill the process
	               On Error Resume next
	               objProcess.Terminate()
	               On Error Goto 0
	               End if
	Next
	'wait the given number of seconds
	WScript.Sleep iWaitTimeSeconds * 1000
	Set colProcess = nothing
Loop


WScript.Quit '(won't get here if it is coded right)
'End of script

'sub routines

'debugging
Sub GoDebug(strMessage)
Dim m

	If Not debugging Then Exit sub

	m = MsgBox(strMessage & vbCrLf & vbCrLf & "Click [Cancel] to abort",49,"Process Tracker Debugging")
	
	Select Case m
	Case 2
		WScript.Quit
	Case Else
	End select

End Sub

'send email
Sub SendEmail(strUser, strMessage, strComputer)
	Dim objEmail
		
	Set objEmail = CreateObject("CDO.Message")
	objEmail.From = "<<>>"
	objEmail.To = "<<>>"
	objEmail.Subject = strUser & " has been naughty."
	objEmail.Textbody = strUser & " was prevented from running the following application:" _
		& vbCrLf & "Time: " & FormatDateTime(now(),0) _
		& vbCrLf & "PC:   " & strComputer _
		& vbCrLF & "App:  " & strMessage
	objEmail.Configuration.Fields.Item _
	    ("http://schemas.microsoft.com/cdo/configuration/sendusing") = 2
	objEmail.Configuration.Fields.Item _
	    ("http://schemas.microsoft.com/cdo/configuration/smtpserver") = _
	        "<<>>" 'Modify to your SMTP Server Address
	objEmail.Configuration.Fields.Item _
	    ("http://schemas.microsoft.com/cdo/configuration/smtpserverport") = 25
	objEmail.Configuration.Fields.Update
	objEmail.Send
End Sub

[OverWorked]

The above method does block executables like .bat, and .exe, but does not block .swf, even if you add it to the Designated File Types.

 

I'm not sure what's going on, but the Desgnated File Types list by default includes items like .lnk and .url but the policy doesn't disallow these.

 

I've added SWF file type and it doesn't block that either.

 

Any ideas why it's only applying to some file types and not others?

 

(We're wandering off topic now, which was how to block executables. I might start another thread).

[mortstar]

The above method does block executables like .bat, and .exe, but does not block .swf, even if you add it to the Designated File Types.

 

I'm not sure what's going on, but the Desgnated File Types list by default includes items like .lnk and .url but the policy doesn't disallow these.

 

I've added SWF file type and it doesn't block that either.

 

Any ideas why it's only applying to some file types and not others?

 

(We're wandering off topic now, which was how to block executables. I might start another thread).

 

This is exactly the situation I'm in.

 

executables have been blocked from running from Home Areas and pen drives for a couple of years. Recently we've had a spate of Flash Games running from pen drives. I thought adding .swf to Designated File Types would lock them down, but it doesn't seem to take effect

 

Those who have it working are you blocking from User Config, Computer Config or both?

[thomaswp]

I have deployed the policy now. I did not put in the WUSB thing, just blocked all drives apart from C:, and added %UserProfile% too.

 

This works nicely, but:

 

- their "My Documents" is the X: drive and they are still able to execute exe files on that drive despite my disallowing x: and %HOMEDRIVE%%HOMEPATH%.

- worse, one of the files that is run is automatically extracting an exe file to a temp folder in their user profile and running that with no problems despite it being on the %UserProfile% path

 

I have just added \ to the end of the above AND added \\server\Student$\%USERNAME\ to the disallowed list. I have also added the name of the one exe I know of that so far that copies to the temp folder to my process tracking script mentioned above. It might put them off but is not a long term solution.

 

I have also noticed that my login script no longer runs and throws a wscript error despite me making \\server\SYSVOL\domain\ unrestricted

 

Later: with the changes described, everything started working. I worked out that the login error was my own process tracker being launched in to a temp file and being blocked by the policies which had started working properly.

Edited March 24, 2010 by thomaswp
Everything started working :D

[OverWorked]

I've started a new thread, as it's changed topic from .exe file to .swf.