haleman

Actually I have about 400 XP spk2 clients and the rest Win Vista. Started deploying Win 7 recently for a total of about 10 Win 7. It works in all of them. If you have any other question, let me know. Happy to help. I know how it feels!

All I'm doing is using the software restriction policy and in the path typing somethng like E:\*.exe. I did the same for other extensions such as dll, bat, msi, etc. Don't forget to select "disallowed"

While I was typing the previous message, I was burning the folder structure to cd and just finished testing it. It also works. The executables I'm testing with are u995.exe (ultrasurf) and Tor, plus a couple of batch files.

Hi: I created this folder structure 1 folder 2 folder 3 folder 4 folder 5 folder 6 folder and moved exe and bat files to every folder and it worked in all of them. I also applied the same domain policy to floppy drives mapped to A and it also worked.

Kyle: I had the same issue and came up with a solution that does not require third party tools and it works every time . You can do it using domain software restriction policies and specified the path and the extension to block, such as *.exe or *.bat, while allowing documents to be opened from those locations. open the group policy management tool and navigate to computer config windows settings software restriction policies (right click on it to populate the right pane) then right click on security levels and make sure you have the "disallowed" and "unrestricted" policies. If you dont have them right click and create them. then right click on "additional rules" and click on NEW PATH RULE. If your USBs are, let's say, in E Drive and you want to block all exe extensions, then PATH: E:\*.exe SECURITY LEVEL: Disallowed and click oK. You can add more path rules for extensions such as .bat, .vbs, etc. You would need to restart the workstations to refresh the policy in all. The policy has to be linked and enforced in whichever OU you want to implement it in. You can use PsTools to restart all workstations remotely. (you can get the entire list from AD) Good luck!