1

I am currently using GPO (Computer>Windows>Security>Software>Additional) to lock down several file types from running in places like C:\ and %appdata% and %userprofile%. My issue is that certain folders like "Documents" are redirected to shares while "Downloads" are not. Using %userprofile%\*\*.exe I can block executables in "Downloads" (not redirected) but I CANNOT block items in "Desktop" (redirected). I have tried \\profiles\*\Desktop\*.exe but that does not work either. Any Ideas?

2 Answers 2

2

You've got it backwards. You should block EXE's from everywhere, except on whitelisted paths.

But to answer your question directly, you will need to specify the redirected path in the rule, not the original path. That's why your rule is not working.

7
  • The path has variables. I can't create GPOs for 5K users * 4 folders.
    – user206106
    Oct 18, 2018 at 21:58
  • More specifically, I need something similar to \\profiles\*\Desktop\*.exe but that works.
    – user206106
    Oct 18, 2018 at 21:59
  • You don't need to be that specific. Just block the entire share.
    – longneck
    Oct 19, 2018 at 12:59
  • There are folders within each user profile that have items that do need to be run including login scripts. That's not a practical solution.
    – user206106
    Oct 19, 2018 at 13:26
  • It sounds more like you have an over-complicated setup. Why are you running exe's from user profile folders?
    – longneck
    Oct 19, 2018 at 13:29
0

You are using Software Restriction Policies, since it's deprecated in Windows 10 I recommend you to take a look at AppLocker and implement it on a lab environment first.

You'll be able to do what you want with it since it's blocking everything by default, however you can add trusted path/patterns easily.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .