Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have using Windows server 2008 R2 edition.

I need the group policy for disable download option for domain users.

Anyone please let me know the policy settings.

Thanks in advance.

share|improve this question
add comment

4 Answers 4

What you're looking for sounds like a simple thing but it really isn't.

When you say "all browsers" I tend to think that you're talking about third-party web browser software (Google Chrome, Firefox, Opera, wget, curl, etc). You're going to find that third-party web browser software is less amenable to being controlled by Group Policy than Internet Explorer.

By "downloading" I think you're saying "saving the contents of HTTP(S) accessible resources to disk files while still allowing the user to view web pages". Considering that's exactly what a browser does when accessing web sites to allow users to view pages I think you're going to have a tough time of this. If the machine is able to arbitrarily communicate with other hosts via HTTP(S) and the user can execute arbitrary code then users can "download".

Your options are to remove the user's ability to execute arbitrary code and/or remove the ability for the computer to arbitrarily communicate with other hosts. Software Restriction Policy is your best bet for the first, and a web filter device / application is your best bet for the second.

You can play games with the IE "Security Zones" and other settings via Group Policy but a determined attacker is going to be able to get around such games even if they can't execute arbitrary code. If the attacker can just run a copy of wget they bring in on their own storage media then all the Group Policy machinations in the world aren't going to help you, either.

share|improve this answer
add comment

You can not. MOsst browsers will give crap about your GPO.

Chrome, Firefox all have no setings for that. IE may have, but hey, you ask about all browsers.

So, no - no way. Sofwtare does what it is programmed for.

share|improve this answer
add comment

Internet Explorer and Chrome can be controlled by GPO, Internet Explorer via MS supplied GPOs.

For IE Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Internet Zone > Allow File Downloads will give you control for Internet Explorer.

I chrome, I've not found a way to block downloads specifically, but you can set the download directory to somewhere where the user would not write permissions - that may possibly work.

In a domain environment you can also create a policy to stop files from running from certain areas.

Firefox does have some GPO options but it does have to be set up - you use GPO to set what you want, when the user logs on an application has to be run which will read those settings and write them into the config file which then Firefox reads when it starts up.

share|improve this answer
add comment

The only way to truly achieve what you want is to restrict internet access at the network level. This can be achieved by something like an in-line proxy, or by adding ACL's to your outbound ports which prevent requests originating from IP's which aren't either servers or the proxy.

You really shouldn't rely on client side restrictions for this.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.