I have an issue with users running .exe's from removable storage such as Memory Sticks and SD cards.
I am trying to set up blocking of exe's being ran from all removable storage to combat this, however under the Group Policy settings under "User Configuration > Windows Settings > Security Settings > Software Restriction Policies > Additional Rules" you can create a "path" variable. I would like to use a system variable for all removable storage but do not know if there is one that works. Do I have to go through and create a blocklist for all potential drive letters that could be assigned to removeable media (E:\ through to about L:\) or is there one that actually works? I've found %~dp0
which, apparently, only works for for loops, if statements and batch parameters.
If there are other, better, or more reliable measures please let me know.
Oh, I've looked at AppLocker but our DC is running Server 2008 and I believe that AppLocker is part of Windows 7 and 2008 R2. As mentioned in the comments to the answer below I don't think Server 2008 has the "Deny Execute Access" setting, so are there any other options?