Preventing .exe's based on location? 1

[acl03]

I have a 2003 R2 Citrix/TS server farm for remote access. The OU containing the 2 servers has a fairly restrictive GPO attached.

One thing I cannot seem to find a way to restrict is running .exe files. I have removed access to all local server drives, but they do have access to their network drive.

What is to prevent them, for example, from copying an .exe to one of their network drives while at work (such as VNCViewer.exe) and running them from home on the remote server? I know I can restrict by name, and there are some exe's that i DO want them to be able to run.

Is there a way to create a rule to prevent any programs from being run from a certain network drive? I would like them to be able to run any exe that is on U: (users do not have write access), but none that are on P: (where users DO have write access).





Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!

 

[Roadki11]

Did you try using NTFS permissions and remove the Execute privilage from the location you dont what them to run exe's from?

RoadKi11

"This apparent fear reaction is typical, rather than try to solve technical problems technically, policy solutions are often chosen." - Fred Cohen

 

[IllogicallyLogical]

You could look into using "Software Restriction Policies" and configuring path rules.

- Using Software Restriction Policies to Protect Against Unauthorized Software

http://technet.microsoft.com/en-us/library/bb457006.aspx#EKAA

- Create a path rule

http://technet.microsoft.com/en-us/library/cc781337(WS.10).aspx

Here are some additional Microsoft articles with details for locking down Terminal Server sessions you may find to be useful.

- How to lock down a Windows Server 2003 or Windows 2000 Terminal Server session

http://support.microsoft.com/default.aspx?scid=kb;en-us;278295

- Locking Down Windows Server 2003 Terminal Server Sessions

http://www.microsoft.com/downloads/...ff-9a6e-40c7-b64e-7920e6ae6a0d&DisplayLang=en

Joey
CCNA, MCSA 2003, MCP, A+, Network+, Wireless#

 

[acl03]

Thanks for the responses, guys.

Roadki11 - That won't work, since when these users are in the office I do want them to be able to have execute privileges to these files.

IllogicallyLogical - Looks interesting. I'll go through them all this morning.



Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!

 

[acl03]

Path rules worked like a charm, and the other links gave me some useful information as well. Thanks!

Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!

 

[IllogicallyLogical]

No problem, glad the solution worked for you.

Joey
CCNA, MCSA 2003, MCP, A+, Network+, Wireless#