Need rule to deny access to exe for one group but allow to another?

[bTkalternate]

Hi,

I want to set up a rule in ISA 2006 to stop a particular group of users being able to download executable files but allow the rest of the authenticated users general access.
I've tried setting this up in two different rules but it doesn't work

Rule #1 Deny 'Restricted group' to 'External' with the 'Exception .exe files'.
I've also added this extention to the HTTP configuration of the group.

Rule #2 Allow 'Authenticated Users' to 'External' no exceptions.

I've tried changing the order but doesn't seem to make a difference.

How should I best achieve this?

Regards,
b

 

[bTkalternate]

Sorry, had a revelation and figured the rule would be Deny certain things rather than allow only certain things.
It was messing up as the rule below was saying allow everything.

Fixed up now so thread can be ignored or deleted.

Cheers