laugbr80 Posted March 19, 2012 Posted March 19, 2012 one of our kids has found the old trick of saving shutdown -i into a bat file and then browsing the network. Our logon script is a bat file - so if I put a blanket ban on bat files then the drives don't map to the pcs, there's a restriction on them installing and running executables anyway, but the bat file is obviously dangerous as they could potentially shut down the systems...
bondbill2k2 Posted March 19, 2012 Posted March 19, 2012 (edited) Put a ban in their homepaths and anywhere they are able to save to using software path restrictions(one per location GPOs User Config > Policies > Windows Settings > Security Settings > software restriction policies. Then add all the file types you wish to ban in designated file types Id also use resource manager on your server to prevent .bat files from being saved and alert you of those trying to do so and ban .bat files on your web filter. Stopped the problems we were having Edited March 19, 2012 by bondbill2k2 1
Michael Posted March 19, 2012 Posted March 19, 2012 User Config > Policies > Admin Templates > System - Prevent access to the command prompt - Enabled On this policy, specify No to - Disable the command prompt script processing also? 1
mrbios Posted March 19, 2012 Posted March 19, 2012 User Config > Policies > Windows Settings > Security Settings > software restriction policies Edit the designated file types to include .bat .cmd and so on then go to > Additional rules and add in the location of the users home paths and any other location the kids can save files to where you wouldn't want them running batch files from E.G H:\ Job done 1
chazzy2501 Posted March 19, 2012 Posted March 19, 2012 You could also setup mapped drives using GPP. It's very easy. 1
3s-gtech Posted March 19, 2012 Posted March 19, 2012 Then map network drivers using Group Policy Preferences, so you don't need the logon script to do it (if you have the necessary extensions and server management to do this - so XP onwards and Windows Server 2008 onwards)
bondbill2k2 Posted March 19, 2012 Posted March 19, 2012 I know its easy to setup mapped drives, we currently still use a logon script, would mapping improve logon times?
3s-gtech Posted March 19, 2012 Posted March 19, 2012 I never noticed much difference between the two, but it certainly shouldn't increase. Tend to find that these scripts run fast anyway as it's pretty simple.
IrritableTech Posted March 19, 2012 Posted March 19, 2012 What are they running in their bat files? If you network has the correct file permissions, this shouldn't really be a problem should it? With everyone banging on about coding in the classroom, if they can do no damage, why stop them coding a script? It's how I learnt when I was at school!
CyberNerd Posted March 19, 2012 Posted March 19, 2012 What are they running in their bat files? If you network has the correct file permissions, this shouldn't really be a problem should it? With everyone banging on about coding in the classroom, if they can do no damage, why stop them coding a script? It's how I learnt when I was at school! I'm with you on this. Having just installed a python interpreter on all student workstations I'm waiting to see what's the worst that can happen. 1
laugbr80 Posted March 19, 2012 Author Posted March 19, 2012 Ok let me explain more clearly, there may be a couple of misunderstandings. The students log on with a logon script that redirects to a bat file which refers to Desktop Authority which is where we have mappings of printers, folder shares and shortcuts etc so the students, when bat file is not allowed to run by GPO (which is the first thing I put into place when I realised they could run the bat files which they're running from memory sticks or saving in notepad and running), their drives are not mapped, and DA is unable to run it's scripts. It's a shoddy setup, I know, but rather than having to redesign all our logon scripts and permissions, and domain policy, how can I stop the users actually executing their own bat files? They're running things like shutdown /i and browsing, so they can see the network, and there were a couple just identifying the primary server. They can't do that much with them, I know, but when the kids bring up a list of networked computers and say 'look miss, I can hack into the netwoirk', then you have a bunch of teachers running round worrying about their security to the senior leadership team saying that the pupils are able to hack the network. It's just less hassle if they can't have access to this at all. They don't have permissions to access the drives of these machines, but can actually run the shutdown, so therefore can cause trouble by shutting down machines at the very least...
timzim Posted March 19, 2012 Posted March 19, 2012 Michael gave you the answer, above. Follow his instructions to restrict their access to the command shell, then you won't get the problems you're getting. Your login scripts will still run.
laugbr80 Posted March 19, 2012 Author Posted March 19, 2012 With this GPO implemented on the pupil users OU I can still save a bat file to the desktop and run it as a pupil - I tried this before I posted my thread, and have just tried it again to make sure I wasn't being stupid...
laugbr80 Posted March 19, 2012 Author Posted March 19, 2012 Apologies, after a gpupdate /force the gpo did kick in. But when logging on as a user with this implemented, the DA Script logon window that normally pops up when applying DA scripts now reads 'The command prompt has been disabled by your administrator', and as I stated in the first post, wouldn't map any drives or printers which are allocated through DA's logon bat file
mrbios Posted March 19, 2012 Posted March 19, 2012 Apologies, after a gpupdate /force the gpo did kick in. But when logging on as a user with this implemented, the DA Script logon window that normally pops up when applying DA scripts now reads 'The command prompt has been disabled by your administrator', and as I stated in the first post, wouldn't map any drives or printers which are allocated through DA's logon bat file Go back to my previous post and do that instead. Software restriction policies is exactly what you want. 2
laugbr80 Posted March 19, 2012 Author Posted March 19, 2012 Go back to my previous post and do that instead. Software restriction policies is exactly what you want. Surely this is going to stop the bat file that runs at logon for the user still??
mrbios Posted March 19, 2012 Posted March 19, 2012 (edited) Surely this is going to stop the bat file that runs at logon for the user still?? Nope, because you can customise the exact locations of which you don't want people to be able to run batch files from. Unless your logon scripts are running from the same folder that kids can save their own batch files to then it shouldn't be a problem (and if that was the case i'd say it's time to change the way things worked!) In the grand scheme of things though I'd highly recommend modernising and moving away from scripts, GPPs can do everything for printers, drive mapping etc. these days, scripts are becoming a bit old hat. Edited March 19, 2012 by mrbios 1
ricki Posted March 19, 2012 Posted March 19, 2012 HI Dont forget to put the restrictions on the drives that are assigned to the usb sticks. Richard 1
DJ-1701 Posted May 25, 2017 Posted May 25, 2017 Thanks MrBios. Perfect solution. @ArthurDent What are you doing here?! Get back in the http://www.edugeek.net/forums/jokes-interweb-things/170681-towel-day.html thread!
mavhc Posted May 25, 2017 Posted May 25, 2017 I just whitelist only places only I can write to, also kills all viruses/ransomware pretty much
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now