Group Policy loop hole

[KLewisBPM]

I have set the rule only run allowed windows applications, this is great because the only exe files it runs are the ones I set in the list.

The main idea was to stop users running iexplore.exe, but it was easier to block all and allow the odd couple of programs needed.

When trying to run iexplore, great! error, thats what i expected.

Run "my computer" i can see my C Drive! thats ok all other drives are blocked. ok so I type a web address in windows explorer!! Oh No! its working.

Any ideas greatly recieved!

Kind Regards

Kelley Lewis

 

[medina289]

is the objective to prevent your users to access the www? some of them or all?

 

[KLewisBPM]

The idea is stop only a couple of users accessing the internet, I could set it so there policy shows a proxy server that doesn't exist and due to other restrictions they shouldn't be able to change that.

If you have a better idea I am keen to hear

Thanks for your response!

Kind Regards

Kelley Lewis

 

[medina289]

I have a small network (1 server and 8 workstations) and I only granted Internet access to two workstations. They are the only ones where I cinfigured a default gateway. It's a bit "snickerware" and a solution for small intranets.

 

[PScottC]

I just replicated your issue and watched the processes running on my machine. When I run the URL, it opens it using explorer.exe. Hmmm...

I would say that either a false proxy, or configuring limitations on your firewall would be easier.

One problem that you may find with your current policy is that users may need an executable that you don't expect them to need. On my system (WinXP) I count 21 applications in the Windows directory and 348 in the system32 directory. Which ones will your users need?

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers