0

I am working for an organization which helps people with mental disabilities. All of them have a user account in our AD.

The client computers are running a mix of Windows 7 and 8.1, and the server is Win2k8R2.

Lately, we have discovered that some users are downloading unwanted files, like .mp3 and .flac files. Some times, these files are archived into .rar or other achiving formats.

I am now looking for a program that can help us prevent, or atleast immediately when download has finnished, scan the file for unwanted files.

I am quite sure this would be very hard to fix through a GPO, as we are not only using IE, but also Chrome and firefox.

Is there any of you who would have any ideas of how to achieve this?

Best regards /Rickard

||improve this question
  • Maybe you can use Squid with Squidguard to deny mp3's download – Benjamin Dénécé Mar 4 '15 at 10:34
4

The typical technical approach is to install a HTTP proxy server where you implement your download restrictions/policies.

Then you can use a GPO to enforce that the proxy server gets used (assuming that your computers are all AD domain members) and as the next phase you block direct internet access at your gateway/firewall.

Normally you precede the technical implementation by agreeing on a Internet Usage Policy (SANS template) with management and your users, as people might (rightfully) complain about the potential privacy concerns they could associate with "monitored internet access".

||improve this answer
  • Thanks. But would the HTTP Proxy server scan compressed archives for unwanted files aswell? Regarding IUP, we already got one, the problem is that some users seem not to care or understand (we are working with mentally ill people, so we can not expect everyone to follow the rules. However, we can not ignore the problems either. Disabling their account is n ot an option either, even though I wish we could, that would mean problems for the organization and what we are doing. So we need to find a way to allow usage, but prevent certain downloads. – Rickard Mar 4 '15 at 11:48
  • The IUP is the framework with the restrictions in which you can operate and do your content filtering, good that one is already in place. File-name extension exclusions are typically trivial, scanning within archive files is also something that for instance anti-virus software already does, so shouldn't be too difficult but support depends on the product, typically only password protected archives are difficult and often those are banned outright. But get your requirements straight and start doing your homework. – HBruijn Mar 4 '15 at 12:54
  • I'm sorry, but I don't really like how you are ending your last comment. I know my requirements, and I am not asking for a working solution, but rather asking for directions, as I do not know where to look. You can't do your homework, if you don't know what to work with! With IUP, I take it as you are talking about a simple policy document which the users has to agree and sign. - This is what I mean is done. Now I need something to screen downloaded files with, and my question is not "Help me set it up!" But rather "Please recommend something I can use!". Our AV solution can not do this. – Rickard Mar 4 '15 at 13:37
  • My last sentence isn't intended as condescending, but more along the lines of the ServerFault policy with regards to product recommendations: I don't know anything about your environment, number of users, IT policies and budget, available skills etc. Only YOU can decide what is the most suitable for your environment. I'm pretty sure that a proxy is the correct way to prevent downloads but the exact capabilities differ from product to product. Benjamins comment directs you to a common OpenSource proxy, but there are a number of commercial products as well. – HBruijn Mar 4 '15 at 14:13
  • I apologize, I took it as a bit condescending, even though you didn't mean it that way, so all is good. In my frustration after having searched Google for a few hours without any useful information, I just wanted some recommendations of how to achieve my goal, without thinking of the ServerFault policy. I will look at Benjamins recommendation and see what I can do with it. :) – Rickard Mar 5 '15 at 0:15
1

It depends on how the users are using the workstations in question--are they supposed to be saving files, or are these generic workstations? Is the problem that you don't want them listening to music, or that they're downloading viruses with their music? (I also don't know your budget.)

Depending on this, I'd probably use multiple approaches.

  1. Proxy server, which HBrujin and Benjamin Dénécé covered well. There are both open source and for-pay options. This should be the first line of defense.
  2. Some antivirus programs will prevent downloading files with certain extensions--maybe yours is one of them? (Does your AV have a centralized management console?)
  3. A software restriction group policy that forbids common unzip programs, iTunes, etc.
  4. Block USB drives via group policy (to stop them from bringing in music, videos, and viruses from home).
  5. If they're not supposed to be saving material on their workstations at all, a product like Deep Freeze or a competitor might help. (If you go this route, you might need to allow USB drives to give them a legitimate place to save files.)

Good luck!

||improve this answer
0

I am now looking for a program that can help us prevent, or atleast immediately when download has finnished, scan the file for unwanted files.

Start with Next-Generation Firewall

Install UNTANGLE as Router. With it, You can prevent downloading files with extensions like mp3, mov etc. Beside that You can setup MIME scanning to block files with fake extensions.

You can set logging and an email event alerts on various networks incidents.

I am quite sure this would be very hard to fix through a GPO

It's impossible to set file screening by gpo on local hard drives. One thing You can do using ad and gpo is, to prevent storing any data on local disk, and redirect users to network share, where you can setup File Screening on Windows Server with File Server Resource Manager, and efficiently stop saving particular file types.

Another idea is to run simple batch file, that will scan hard drive periodically and delete all files with specified extensions.

||improve this answer
-1

I think a UTM device such as a Watchguard or Sonicwall would be a cheaper option in the long run rather than spending all that time trying to get group policy to deal with internet traffic. Stick to using something made for the job...

||improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.