Prevent users from downloading certain files

Question

I am working for an organization which helps people with mental disabilities. All of them have a user account in our AD.

The client computers are running a mix of Windows 7 and 8.1, and the server is Win2k8R2.

Lately, we have discovered that some users are downloading unwanted files, like .mp3 and .flac files. Some times, these files are archived into .rar or other achiving formats.

I am now looking for a program that can help us prevent, or atleast immediately when download has finnished, scan the file for unwanted files.

I am quite sure this would be very hard to fix through a GPO, as we are not only using IE, but also Chrome and firefox.

Is there any of you who would have any ideas of how to achieve this?

Best regards /Rickard

Answer 1

The typical technical approach is to install a HTTP proxy server where you implement your download restrictions/policies.

Then you can use a GPO to enforce that the proxy server gets used (assuming that your computers are all AD domain members) and as the next phase you block direct internet access at your gateway/firewall.

Normally you precede the technical implementation by agreeing on a Internet Usage Policy (SANS template) with management and your users, as people might (rightfully) complain about the potential privacy concerns they could associate with "monitored internet access".

Answer 2

It depends on how the users are using the workstations in question--are they supposed to be saving files, or are these generic workstations? Is the problem that you don't want them listening to music, or that they're downloading viruses with their music? (I also don't know your budget.)

Depending on this, I'd probably use multiple approaches.

1. Proxy server, which HBrujin and Benjamin Dénécé covered well. There are both open source and for-pay options. This should be the first line of defense.
2. Some antivirus programs will prevent downloading files with certain extensions--maybe yours is one of them? (Does your AV have a centralized management console?)
3. A software restriction group policy that forbids common unzip programs, iTunes, etc.
4. Block USB drives via group policy (to stop them from bringing in music, videos, and viruses from home).
5. If they're not supposed to be saving material on their workstations at all, a product like Deep Freeze or a competitor might help. (If you go this route, you might need to allow USB drives to give them a legitimate place to save files.)

Good luck!

Answer 3

I am now looking for a program that can help us prevent, or atleast immediately when download has finnished, scan the file for unwanted files.

Start with Next-Generation Firewall

Install UNTANGLE as Router. With it, You can prevent downloading files with extensions like mp3, mov etc. Beside that You can setup MIME scanning to block files with fake extensions.

You can set logging and an email event alerts on various networks incidents.

I am quite sure this would be very hard to fix through a GPO

It's impossible to set file screening by gpo on local hard drives. One thing You can do using ad and gpo is, to prevent storing any data on local disk, and redirect users to network share, where you can setup File Screening on Windows Server with File Server Resource Manager, and efficiently stop saving particular file types.

Another idea is to run simple batch file, that will scan hard drive periodically and delete all files with specified extensions.

Answer 4

I think a UTM device such as a Watchguard or Sonicwall would be a cheaper option in the long run rather than spending all that time trying to get group policy to deal with internet traffic. Stick to using something made for the job...