Googled about this but did not find the answer, Id like to give my domain users the ability to run batch files ONLY from network shared path which i'll create and put the files into. is it possible to do it by GPO ?
Since Windows 10 1803 Software Restriction Policies are deprecated and no longer recommended so I'm going to restrict myself to Applocker.
You can implement Applocker policies via GPO and can use it to restrict or allow scripts/exes/apps/dlls
You need to create a new GPO in which you'll need to navigate to "Computer Configuration" > "Policies" > "Windows Settings" > "Security Settings" > "Application Control Policies" -> "Applocker"
First you need to "Configure rule enforcement" there you need to set the checkmark at "Script Rules" and can decide between "Enforce Rules" and "Audit only".
Enforce Rules is used to force the computer to respect the rules while "Audit only" simply generates a Windows Event which will indicate if the current rules will block or allow something to run. It is recommended to use "Audit only" until it is clear whether enabling the rules will break something important.
There you have the different categories
- Executable Rules
- Windows Installer Rules
- Script Rules
- Packaged App Rules
In your case you need to edit Script Rules. Those rules will be enforced for e.g.
bat files (see here for more)
When editing a ruleset for the first time Windows should prompt if you want to add the default rules normally those rules should not break anything and can be added without worrying too much.
Applocker policies will by default fail close This means if you don't have policies defined to handle normal use cases those will be blocked!
Then you can create a new rule by right-clicking either on "Script Rules" and then clicking on "Create New Rule...".
The rule creation dialog is more or less self explanatory. What you want is a "Path Rule" which will allow scripts to run from a given path.
Be aware that
\\server.fqdn.com are different paths
For Applocker to run at all there are a few conditions which will need to be met.
- You either need Windows 10 Education or Enterprise if you want to manage it via GPO 1.1. If you don't you can still administer Applocker via powershell.
- You need to enable and autostart the "Application Identity service"