Stopping .exe files from being run from a USB stick

[aerospacemango]

Totally invaluable!

 

This will stop the little blighters from bypassing our Sophos proxy box!!!!

[haleman]

I think this has been covered many times but i can't seem to find older posts when i search,

 

Is there a way to stop kids from running exe files from the usb keys they bring into school? We don't want to ban them altogether but wondered if there is away to stop this.

 

Sorry if this has been answered before but i can't find it.

 

 

Kyle:

 

I had the same issue and came up with a solution that does not require third party tools and it works every time . You can do it using domain software restriction policies and specified the path and the extension to block, such as *.exe or *.bat, while allowing documents to be opened from those locations.

 

open the group policy management tool and navigate to

computer config

windows settings

software restriction policies (right click on it to populate the right pane)

 

then right click on security levels and make sure you have the "disallowed" and "unrestricted" policies. If you dont have them right click and create them.

 

then right click on "additional rules" and click on NEW PATH RULE. If your USBs are, let's say, in E Drive and you want to block all exe extensions, then

PATH: E:\*.exe

SECURITY LEVEL: Disallowed

and click oK.

 

You can add more path rules for extensions such as .bat, .vbs, etc.

 

You would need to restart the workstations to refresh the policy in all. The policy has to be linked and enforced in whichever OU you want to implement it in.

 

You can use PsTools to restart all workstations remotely. (you can get the entire list from AD)

 

Good luck!

[cookie_monster]

Kyle:

 

I had the same issue and came up with a solution that does not require third party tools and it works every time . You can do it using domain software restriction policies and specified the path and the extension to block, such as *.exe or *.bat, while allowing documents to be opened from those locations.

 

open the group policy management tool and navigate to

computer config

windows settings

software restriction policies (right click on it to populate the right pane)

 

then right click on security levels and make sure you have the "disallowed" and "unrestricted" policies. If you dont have them right click and create them.

 

then right click on "additional rules" and click on NEW PATH RULE. If your USBs are, let's say, in E Drive and you want to block all exe extensions, then

PATH: E:\*.exe

SECURITY LEVEL: Disallowed

and click oK.

 

You can add more path rules for extensions such as .bat, .vbs, etc.

 

You would need to restart the workstations to refresh the policy in all. The policy has to be linked and enforced in whichever OU you want to implement it in.

 

You can use PsTools to restart all workstations remotely. (you can get the entire list from AD)

 

Good luck!

 

 

I tried this method and one flaw is that it only works to about 3 or 4 folders deep, try creating a structre and see if you can run an .exe file from E:\folder1\folder2\folder3\folder4\folder5

 

In the end we blanket banned all exes except from where we specified that they could run.

[haleman]

Hi:

 

I created this folder structure

1 folder

2 folder

3 folder

4 folder

5 folder

6 folder

 

and moved exe and bat files to every folder and it worked in all of them. I also applied the same domain policy to floppy drives mapped to A and it also worked.

[haleman]

While I was typing the previous message, I was burning the folder structure to cd and just finished testing it. It also works. The executables I'm testing with are u995.exe (ultrasurf) and Tor, plus a couple of batch files.

[cookie_monster]

Interesting there are several threads on here documenting that flaw and I observed it as well. Are you using a whitelist rather than a blacklist so all exes are banned everywhere except where you specify or allowing them everywhere except where you specify they're banned.

 

Thanks.

[haleman]

All I'm doing is using the software restriction policy and in the path typing somethng like E:\*.exe. I did the same for other extensions such as dll, bat, msi, etc.

 

Don't forget to select "disallowed"

[cookie_monster]

Ah XP clients? I still get the issue here it's banned in the top three folders of the path any deeper and I can run an exe.

[haleman]

Actually I have about 400 XP spk2 clients and the rest Win Vista. Started deploying Win 7 recently for a total of about 10 Win 7. It works in all of them. If you have any other question, let me know. Happy to help. I know how it feels!

[TheSchoolKid]

as you can see by my user name i am a kid you all are pretty good coders yet my firiend has a .bat file which can still operate with these scripts in place and with the settings applied

[ikmps]

Hi all

 

We have got a number of netbooks for the kids starting in September some running XP home and some running Windows 7 starter. The netbooks will be standalone and wont be on the domain, the kids will logon with a standard (restricted) account is there anyway to stop the kids from running exe, bat, swf etc from usb and the homefolders. I have seen the various methods using GPO but the home versions dont have gpo support. I am at present running a Cyber-D's Autodelete on logon which remove exe's etc from the home folder.

 

thanks

 

Paul

[OverWorked]

IME the GPO methods don't fully work anyway. It would require a third-party paid-for solution.

 

I've had a few suggestiions for Sophos, but it can only be made to scan additional filetypes for viruses. It won't block filetypes outright.

 

Even Faronics don't have a product that can do this. I asked them at BETT last year.

 

This should be really simple. Just deny access to files matching U:\*.swf with subfolders. How hard can that be?

 

I've added a file screening policy to the Server 2008 file server, to block .swf and executables, which at least keeps them off the server and irritates the pupils.

[ikmps]

HI

 

I use sophos and Ranger on the network which seems to work more or less. its the standalone netbooks i have the problems with, they have no gpo support and standalone sophos which does not run policies. It looks like i am just going to have use the auto-delete which deletes from the homedrive / desktop etc not memory sticks unless they have them plugged in at logon, but does not stop them running them

 

will keep looking

 

thanks

 

paul

[zag]

Big thanks for this, I've just implemented it for the first time and its working great.

 

All I did was

 

- User configuration >> Windows Settings >> Security Settings >> Software restriction policies (right click >> New software restriction policy)

- Under Additional rules (right click >> New path rule) Add

 

%HOMEPATH%

%HOMESHARE%

U:\ (this is our mapped my documents drive)

 

And thats it

Edited July 19, 2011 by zag

[Stuart_C]

You can ofcourse use FSRM to do the job on the servers (usefull as it will then E-mail you to tell you who is attempting to do what).

 

Apart from that another vote here for using USBDLM and windows group policy.

[rsim8123]

Hi,

 

How do you do this on 2008 R2?

 

Thanks

[ihaveaproblem]

Hi,

 

How do you do this on 2008 R2?

 

Thanks

 

Not read whole thread - But you can use Group Policy software restriction policys to prevent certain file types such as .exe from running. As well as this you can setup FSRM on the file server to prevent these file types from being saved on the network.

 

Here's a bit of guide I quickly found from google that might help setup

The Basics of Windows Server 2008 FSRM (File Server Resource Manager) - Jose Barreto&#39s Blog - Site Home - TechNet Blogs

Using Software Restriction Policies to Protect Against Unauthorized Software

[OverWorked]

I also use FRSM to prevent them saving executables and .swf files to the share. It's another deterrent for them and reduces storage space waste. If you use DFS, like I do, then you also have to set identical policies on each server that hosts the share.

 

I've found another loophole the darlings are exploiting. They can embed .swf files in Office documents. Does anyone know of a way to stop this?

[mstarczak]

As this is still one of the top google returns on this question I thought I'd post the information I found most helpful on this issue.

Using the information from the TechNet article below I had success.

Chapter 6: Software Restriction Policy for Windows XP Clients

 

A mistake I was doing was typing in the file path and specifying the type of files.

So, f:\*.exe simply blocked exe files from running in the root of the F drive.

What I needed to do was to block exe files from running on the F drive completely, no mater what level of folder they were in.

So, f:\ would achieve this, but it wasn't blocking anything.

For that, I actually had to read the instruction properly, and take note of the sections titled "DLL checking" "Skip administrators" and "Defining executables". These sections are within "The File path rule"

After doing that it worked.

I'm also going to look at a couple of other possibilities that may assist people, but more when I know I've achieved what I want.

Edited September 8, 2013 by mstarczak
fuller information