Group Policy question

[jendar]

Trying to setup a GP to prevent users from being able to download from the internet.

Is this possible with GPs or should I just use a reg hack?

TIA

 

[dberg35]

If you are worried about downloading like music or software I would close all ports accept nessasory ones. Also make sure all users can not install software.

 

[jendar]

None of the users have admin rights but they are able to download from the internet and install. I have seen it first hand. I had a user download and install WinRAR without any complications.

They aren't able to install an application from a CD/DVD.

 

[dberg35]

Then they must have admin acces to the PC's. I would check that domain user do not have admin rights on the local pc. Other issue could be is they may have the admin password.

 

[TechyMcSe2k]

There is a section in GP under User config/admin temp/windows components/IE/Security Features/Restrict File Download
You can also turn off Media Sources under
User config/admin temp/windows components/IE/Windows Installer
And under
Computer config/admin temp/windows components/IE/Windows Installer you can Prohibit User Installs

 

[TechyMcSe2k]

User config/admin temp/windows components/IE/Internet Control Panel/Security Page/internet Zone...There is an allow file Downloads. If you disable this, files are prevented from being download in this zone only.

 

[jendar]

Thanks Gents.

Your input has been appreciated.

 

[TechyMcSe2k]

You can also leverage Software Restriction Policies in your network.
Per

http://www.windowsnetworking.com/articles_tutorials/Software-Restriction-Policies.html

"An Internet Zone rule is similar to a certificate rule in that it can only be used to restrict Windows Installer packages. The difference between an Internet Zone rule and a Certificate Rule is that an Internet Zone rule is designed to prevent users from downloading and installing software.

At the time of the download, Internet Explorer looks to see what zone the download site falls into. Internet Explorer classifies any Web site visited into either being in the Internet, Local Intranet, Trusted Site, or Restricted Site zone. You can create a software restriction policy that allows files to be downloaded and run if they come from the local intranet or from a trusted site, but that won’t allow files from other locations to be executed."