We (were) facing the same problem at our organisation. At first we were using Group Policy's Software Restrictions to block unwanted programs, but students found ways around that, including opening the file in Notepad, changing a byte at the end then saving. One byte changed = brand new hash = not blocked. Worked quite well, even though they were editing it in Notepad.
So we took the extreme measure. We created a GPO that would:
Prevent certain filetypes from being run (including EXE, BAT, DLL, OCX)
Prevent certain filetypes from being copied anywhere
Delete the offending filetypes from their home (H:\) drive
ONLY run in the "Students" OU (So it didn't affect staff)
Only run on H:\, C:\Documents and settings\%username%, D, E, F, G, I, J, K drives, %temp% (basically anywhere we can't monitor easily). This let us block content on USB drives too.
Block FlashPlayer.exe and varients
And modified our WebMarshal rules to block all multimedia unless the site was in the "Allowed" group.
The results are astounding. Once GP was applied to all machines, game playing dropped to almost zero. We had students and teachers saying "Well what about those who do multimedia or programming?". And the answer is, our curriculum drive (Z:\) isn't affected by the block so students who do multimedia can put files in there (the folder is heavily moderated) and students who do programming don't compile their programs. They send the source to the teacher to view and compile.
Now, with games and other unwanted programs blocked, we have several things to look out for:
Computer damage (bored students = graffitti, smashed screens, broken keys)
Online anonymizer sites (Students were using Opera and Safari to get around website filtering)
Frustrated students. Now that they can't play games, they would focus their attention on bullying others
Emailing. Students are now using email (a provided resource) to "chat" with mates.
But at least now we have one way of managing what they do on the system. Next up, installing iTALC for staff to use!
