Block MSN Messenger or Live with GPO - How to? 2

[bence8810]

Hi

I have been tasked to block MSN for a couple of people, and I found nothing on google strangely. I thought this was a much-required thing for many.

There are ways to disable Windows Messenger, but not MSN. Is there some trick to block it from Running?

Thanks

Ben

 

[IllogicallyLogical]

Look under this policy setting.

User Configuration\Administrative Templates\System

Find the policy "Don't run specified Windows applications", enable the policy and click Show by List of disallowed applications. Add the name of the executable. You will need to know the specific executable name of the application.

Or use the Software Restriction Policy. This is a more versatile policy.

- How To Use Software Restriction Policies in Windows Server 2003

http://support.microsoft.com/default.aspx?scid=kb;en-us;324036

- Using Software Restriction Policies To Keep Games Off Of Your Network

http://www.windowsnetworking.com/articles_tutorials/Software-Restriction-Policies.html

Joey
CCNA, MCP, A+, Network+, Wireless#

 

[bence8810]

Hi

Thanks, your first "easy" solution worked like a charm. Of course I can still run messenger from the command line, but hope my users wont notice that.

They already complained this morning, but I had to put the blame on the boss

Thanks again wonderfully done,

Ben

 

[porkchopexpress]

Did you use software restriction to ban it? if so you shouldn't be able to run it from the command line either.

 

[bence8810]

Hi

I used the easy-method, "Don't run specified Windows applications" and it works for now. I will deploy the Software restrictions once I manage to find the time.

Thanks again for all help,

Ben

 

[bence8810]

Hi

So the first applied restriction was quickly demolished by one user suddenly appearing online, then went back offline. I knew something was wrong, and sure enough, they started it from command line.

What a bummer.

I am deploying Software Restrictions rule in GPO, but I can only bind it to the Path, so if the user moves the applications, msnmsgr.exe in this case, my rule is again overthrown.

What am I to do?

I cannot take admin access, as they have software which requires it....

Thanks for any help,

Ben

 

[ComtekAdvanced]

1. Talk to the person's manager/supervisor. If using IM is against company policy, have them written up.

2. Block access to the login server(s). From my understanding, the main login server is messenger.hotmail.com. But for good measure, block *.hotmail.com and *.live.com.

3. Rather than giving the users full Admin rights, try giving them full permissions on the folder that the program they use is installed in. I have to do this for a couple programs we use and it works perfect.

 

[bence8810]

Hi

Thanks, good thinking on the Admin access to folders only.

Re blocking the Login servers, I am not sure it can be done on individual PCs, can it? We use IE only, so if there is a way, I would like it very much so.

The other way is to block it in Squid Proxy which is what we use, but I am not very experienced, and leaving tomorrow for a 3 week holiday, so no time.

Blocking it completely would surely be a breeze, but blocking it only for a few users takes a couple of ACL's well planned, etc.

If there is an IE setting you can think of for blocking a couple of sites, please let me know,

Thanks

Ben

 

[ComtekAdvanced]

There is an easy way to block MSN Messenger on just a few computers. Edit the hosts file in C:\WINDOWS\system32\drivers\etc. Add the following two lines:

127.0.0.1 messenger.hotmail.com
127.0.0.1 gateway.messenger.hotmail.com

I just tested it on my computer and it prevents me from logging in to messenger. However, being local admins, they can edit that file if they know about it.

This will work with any websites you want to block on a per PC basis. It's great if you need to do it on just a few computers, but can be a pain if you need to do it on a lot of them.

 

[porkchopexpress]

Using software restriction you can create a hash value of the .exe then ban it from being run anywhere on the system.

 

[bence8810]

Hi

Yes, I suppose I could edit the hosts file, and that is something I didnt think of at all. Thanks.

I found a setting in GPO which allows me to block sites with Content Rating, so I added the live.com and all others I was able to find, plus a few local sites that draw a lot of traffic.

I also created the hash rule. Lets say MSN gets updated, will hash still work? I mean the file changes. Of course MSN should not be updated, as there is no way to start it, etc, but if someone else logs on and updates it?

I now have the path rule and the hash rule. Can they live as neighbours, or I need to kill the path, or hash rule?

Thanks

Ben

 

[porkchopexpress]

If there was a new version you would have to rehash it but your users can't install new versions can they?

I think you can use both path and hash rules together.

 

[bence8810]

Thanks a lot, I believe I reached my goal.

Best regards,

Ben