Blocking Firefox install

[googlemad]

How can we easily prevent standard user accounts (a.k.a. Students!) from installing Firefox?

 

They've found they can download the installer, install it then have access to Facebook etc!

[irsprint84]

put something in gpp to look for firefox.exe or whatever its called? per user group not computer group

[MYK-IT]

Remember there is also the portable apps version of firefox (requiries no installation).

 

If you have Sophos, you could enable application control and block firefox etc.

[BarriedaleNick]

Just wondered if anyone has an answer to preventing Firefox/Chrome installs as they do not require admin rights to install any more.

I can block FF in Sophos (group policy is pretty useless) but I would llike a way to prevent them installing it in the first place.

[dany2010]

Remove administrator rights.

 

Students and staff shouldnt really have the rights to install. Massive risk if you let them.

[Achandler]

How are they getting passed your proxy anyway?

 

Surely a standard setup is you go through the proxy or you get no Internet Access? So they would have no reason to try and install Firefox anyway.

 

Secondly group policy is not useless, block them running files except if they are in certain locations. Then they can't run the Firefox installer anyway.

[BarriedaleNick]

Firefox doesnt care if you are an admin or not - every user can install Firefox and Chrome. Try it - I have just tested it on XP and 7 and it installs to the local user folder under a basic user.

Its more than about the proxy - its about setting up what I want in group policy to control IE - Home page, internet Zones etc...

GP is great if you use Software restriction policies or App Locker but the "prevent programs from running" is useless as all you have to do is rename the file - Sorry I should have been more specific on the uselessness of GP.

 

I have Application Control sorted through Sophos but I was just wondering if it is possible (through GP or not ) to stop users installing FF or Chrome - it's not a huge issue more of a surprise when I found that it just installed for anyone..

 

Cheers!

[kernewek-sam]

Block them from saving any files to their user area with the extension .exe and perhaps .msi, as long as they can't save locally.

 

Edit: Block the download pages in your filtering/proxy. Re-read your last post, it is amusing it will install regardless, it sounds like you've found what GP can do on this issue, after I read this http://social.technet.microsoft.com/Forums/pl/winserverGP/thread/53f4bf00-8441-4a79-b023-6c225f883391

Edited July 18, 2012 by kernewek-sam
add info

[old_n07]

You can block programs by file hash value as well as name so regardless of what they rename the file the hash value will be the same and will be blocked.

 

The problem with using a hash is that each new version of the file will have a different hash value.

[BarriedaleNick]

I have no issues with being able to prevent FF from running - I've been using a combination of Software Restriction Policies and Sophos App Control for a while. Sophos is very handy as you don't have to keep up with hash values. App locker looks interesting but I have only just moved to Win 7...

Blocking the main download page is fine but you can download FF from so many sites it seems a bit long winded and then there is Chrome..

As I say I was just surprised it installed under Win 7 with no admin rights and I was sure there was some GP setting I had seen regarding preventing users from installing apps but it seems I am mistaken.

 

Thanks for your input..

[Arthur]

In AppLocker you can block applications based on the publisher of the EXE.

 

http://i.imgur.com/WTMv1.png

 

http://i.imgur.com/JYfa1.png

 

http://i.imgur.com/hc44D.png