Group policy blocking exe's

[tuns8]

Hi all!

 

 

I have created a gpo to block students from running specific .exe's tested it works fine however done another test by renaming the .exe and it bypasses the gpo which a student can do if he or she finds out

 

 

does anyone know of a way to prevent this from happening or is their another gpo im am missing

 

 

 

Thanks guys!

[Steve21]

Depends on what you're running, but you'd want hash rules really. As you found out "path" rules, are exactly that, the path or nothing

 

Steve

[tuns8]

Yes thats true however I think hash rules only works for windows application i.e notepad, regedit etc.

 

sorry didnt explain properly I mean programs e.g. if a user downloads utorrent.exe from the internet

 

sorry its a new school network lol

[Steve21]

Yes thats true however I think hash rules only works for windows application i.e notepad, regedit etc.

 

sorry didnt explain properly I mean programs e.g. if a user downloads utorrent.exe from the internet

 

sorry its a new school network lol

 

Hashes should work on anything, just means new utorrent versions will have seperate hashes etc

 

Steve

[Arthur]

You could also block by publisher if you have AppLocker? For µTorrent that would be BitTorrent Inc.

 

http://i.imgur.com/ZAtzZ.png

[tuns8]

Thanks Steve your right! mate I created a hash rule for utorrent and it works

[Steve21]

Thanks Steve your right! mate I created a hash rule for utorrent and it works

 

Just remember a hash is for "an exe", If there's new versions it'll most likely change hash. So if you can do publisher blocks as Arthur said above, might be worth doing it Saves updating hashes etc.

 

Steve

[Stuart_C]

I've gone for using USB Drive LEtter Manager (DSBDLM) to restrict USB drives to certain drive letters. Then I use Group Policy Software Restriction policies to block all exe and exe type files from those drive letters.

[Steve21]

I've gone for using USB Drive LEtter Manager (DSBDLM) to restrict USB drives to certain drive letters. Then I use Group Policy Software Restriction policies to block all exe and exe type files from those drive letters.

 

Won't they still run if they just copy it locally then? (Or is their homedrive etc blocked seperately)

 

Steve