Allow EXE from USB drive

[X-13]

I know HOW to do it, but it isn't working.

 

Currently, we've set "TotalLock.exe" to be allowed, but it doesn't let us set a file path. So the "No USB EXE files" policy is taking over.

 

I know I can't set the file path to use the volume label instead of the drive letter [stupid windows, why can't you be Unix based.] but I don't want to use the GUID as it's going to be different everywhere [if you know how to force the GUID, that would be handy.]

 

I'm hesitant to try with an absolute drive letter [D:\ in this case] as, depending on how many other USB drives are in use and what order they're attached, the drive letter could be different.

 

 

We're running XP with Server 2003, with CC3 gubbins.

[Jamo]

I know HOW to do it, but it isn't working.

 

Currently, we've set "TotalLock.exe" to be allowed, but it doesn't let us set a file path. So the "No USB EXE files" policy is taking over.

 

I know I can't set the file path to use the volume label instead of the drive letter [stupid windows, why can't you be Unix based.] but I don't want to use the GUID as it's going to be different everywhere [if you know how to force the GUID, that would be handy.]

 

I'm hesitant to try with an absolute drive letter [D:\ in this case] as, depending on how many other USB drives are in use and what order they're attached, the drive letter could be different.

 

 

We're running XP with Server 2003, with CC3 gubbins.

 

http://www.edugeek.net/forums/hardware/56421-cant-figure-one-out-cant-access-usb-drive.html

 

Have you checked that out, looks like the file itself copies to the C: drive to run so could be the cause?

[X-13]

Have you checked that out, looks like the file itself copies to the C: drive to run so could be the cause?

 

Woops. I managed to figure out sharing it [then allowing \\%computername%\TotalLock] as a file path for exe files... But I totally forgot about changing permissions.

 

 

Le EDIT: Yup... that made absolutely no difference.

Edited October 15, 2012 by X-13

[chazzy2501]

The more specific rule always wins in this Group policy. So you should just block exes on all USB drives then specify the hash of the program and it'll work, as it's more specific. (have not tried this but I do remember from training)

[edie209]

The more specific rule always wins in this Group policy. So you should just block exes on all USB drives then specify the hash of the program and it'll work, as it's more specific. (have not tried this but I do remember from training)

 

I am trying to get a piece software to run on one teachers USB Hard Drive and I have been playing with Software Restriction Policies all morning and still I am no further forward. I have created a hash rule and the program just will not run. This is the details below, has anyone had this running. The drive is a Western Digital "My Passport"

 

Unlock.exe (1.4.0.14)WdUnlock.exe

Unlock Utility for WD SmartWare

WD SmartWare

Western Digital

[clareq]

If you're running CC3 just enable a file rule for the particular exe.

[edie209]

Its a Vanilla network, Server 2008R2 and windows 7 clients

[clareq]

Sorry, the OP mentioned CC3

[edie209]

Sorry, the OP mentioned CC3

your right I didn't notice that

[edie209]

I have found a possible solution and I thought I would share it, I found it here http://www.raymond.cc/ but instead of using a shortcut I have used a trigger of when the user logs on. Fingers crossed this will work. I have used a unique admin account so I can disable it if there are any issues.

 

Here are the steps on how to make a program run under Task Scheduler with the highest privileges to bypass the UAC prompt.1. Click the Start button and type Task Scheduler on the search programs and files bar and hit enter.

2. Click Action from the menubar and select Create Tasks.

http://static.raymond.cc/images/1create-task.png

3. You will need to fill up the Name and Description box and check the Run with highest privileges checkbox.

4. Go to Actions tab and click the New button.

5. Make sure that “Start a program” option is selected and browse for the program that you want to run without UAC prompt and click OK. Optionally you can also specify the command line arguments if required.

http://static.raymond.cc/images/2-new-action.png

6. Now go to Settings tab and make sure that “Allow task to be run on demand” is selected. Click the OK button to create the task and you should see the task being added to the Task Scheduler.

7. You can either manually run the program directly from Task Scheduler by right clicking on the task and select Run, or create a shortcut which is very useful when you want to put it on startup. To create a shortcut, right click on Desktop, select New > Shortcut. Type the following location at the box and click Next.

schtasks /run /TN "X-Ray"

http://static.raymond.cc/images/3-create-shortcut.png

You will need to change the X-Ray that is between the double quotes to the name of the task which you’ve used in step 3. You can set any name for the shortcut and click the Finish button. Whenever you need to run the program without the annoying UAC prompt, simply run the shortcut which you’ve created. You can even put the shortcut in Startup folder so that it runs in highest privileges without prompting you to allow the following program to make changes to this computer.

If you totally disable the UAC, you don’t need this but it is good to know that there is a way to bypass the UAC restriction using Task Scheduler. If you have UAC enabled and would like to keep it that way, then you may find this tip useful if you need to run certain programs that requires elevation on Windows startup.