I have an issue with users running .exe's from removable storage such as Memory Sticks and SD cards.

I am trying to set up blocking of exe's being ran from all removable storage to combat this, however under the Group Policy settings under "User Configuration > Windows Settings > Security Settings > Software Restriction Policies > Additional Rules" you can create a "path" variable. I would like to use a system variable for all removable storage but do not know if there is one that works. Do I have to go through and create a blocklist for all potential drive letters that could be assigned to removeable media (E:\ through to about L:\) or is there one that actually works? I've found %~dp0 which, apparently, only works for for loops, if statements and batch parameters.

If there are other, better, or more reliable measures please let me know.

Oh, I've looked at AppLocker but our DC is running Server 2008 and I believe that AppLocker is part of Windows 7 and 2008 R2. As mentioned in the comments to the answer below I don't think Server 2008 has the "Deny Execute Access" setting, so are there any other options?


You can stop execution of software on removable devices via a GPO. The setting is under Computer > Administrative Templates > System > Removable Storage Access > Removable Disks: Deny Execute Access

enter image description here


Do you have access to a Server 2008 R2 System? If so, you could create the policy setting, back it up to disk and transfer it to your Server 2008 System and import the policy back. This won't give you the ability to modify the policy, but you should be able to see the settings as Extra Registry Settings and it should work fine on your Windows 7 clients.

If it helps, I've just created a backup of such a policy, and have put it up on Dropbox for you to download. The usual use at your own risk, etc. applies.

  • Is this a Server 2008 or 2008 R2 feature? I am not seeing the "Deny Execute Access" (or any of the Tape or WPD features). – tombull89 Jan 19 '12 at 15:48
  • Are you definitely looking at the Computer policies and not the User policies? On 2008 R2, they don't feature under the User policies, but do under Computer policies. It might not be available under Computer policies on the non R2 version, in which case I apologise for misleading you. I'm afraid I don't have a non R2 system to check this on though. – Bryan Jan 19 '12 at 15:51
  • Apologies, I was incorrect in my comment above. I do have the Tape and WPD features, just none of the sections have Execute access, only Read/Write. I am under Computer Policies as well. If I view "all settings" it's not in that list either. – tombull89 Jan 19 '12 at 16:03
  • 3
    I don't have a system available to test this on, but maybe you could try downloading the Administrative Templates for Server 2008 R2 and Windows 7. This might provide the policy settings you need to configure your clients. – Bryan Jan 25 '12 at 14:36
  • Installed the Administrative Templates, still not showing the execute access as hoped. – tombull89 Jan 30 '12 at 13:54

Some corporate anti-virus products (e.g. McAfee, Sophos, Symantec) include this function as something that can be enabled corporately. Maybe your corporate anti-virus solution has this as a feature.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.