I am currently using GPO (Computer>Windows>Security>Software>Additional) to lock down several file types from running in places like C:\ and %appdata%
and %userprofile%
. My issue is that certain folders like "Documents" are redirected to shares while "Downloads" are not. Using %userprofile%\*\*.exe
I can block executables in "Downloads" (not redirected) but I CANNOT block items in "Desktop" (redirected). I have tried \\profiles\*\Desktop\*.exe
but that does not work either. Any Ideas?
2 Answers
You've got it backwards. You should block EXE's from everywhere, except on whitelisted paths.
But to answer your question directly, you will need to specify the redirected path in the rule, not the original path. That's why your rule is not working.
-
The path has variables. I can't create GPOs for 5K users * 4 folders. Oct 18, 2018 at 21:58
-
More specifically, I need something similar to
\\profiles\*\Desktop\*.exe
but that works. Oct 18, 2018 at 21:59 -
-
There are folders within each user profile that have items that do need to be run including login scripts. That's not a practical solution. Oct 19, 2018 at 13:26
-
It sounds more like you have an over-complicated setup. Why are you running exe's from user profile folders?– longneckOct 19, 2018 at 13:29
You are using Software Restriction Policies, since it's deprecated in Windows 10 I recommend you to take a look at AppLocker and implement it on a lab environment first.
You'll be able to do what you want with it since it's blocking everything by default, however you can add trusted path/patterns easily.