I'm working on a VM-based desktop solution, and one of the requirements is to restrict normal users from running specific programmes, such as putty. I've explored the GPO methods -- "blacklist" mode could be easily cracked if a user is smart enough to copy putty.exe from a remote folder to his own profile folder and run it from there; and the "whitelist" is just too painful to setup and maintain.

I'm wondering if there is a way to prevent users from copying files into C: drive -- they still need write access as there's other programme writing log files.

Thank you, and any other options is welcome.

  • When you say "blacklist" and "whitelist" are you referring to Software Restrictions or AppLocker?
    – joeqwerty
    Aug 29 '17 at 1:00
  • @joeqwerty, Software Restrictions of Group Policy. All VMs are in a domain.
    – JasonL
    Aug 30 '17 at 5:05

If you want to prevent the user from running programs, perhaps just give read (not read & execute) permission to the user group? This would not solve the problem of disallowing specific programs; not sure if there is any way to do that without a blacklist. Multiple ways around a blacklist, though - many programs do the same function.

What's the overall goal of restricting specific program execution?

  • The programs I want to restrict is putty and WinSCP, does it make sense to you? Only a few users need these tools.
    – JasonL
    Aug 30 '17 at 1:54
  • Sure, but WHY do you want to restrict these? Are trying to block the user from establishing an SSH/telnet session? Even if you restricted PuTTY the user could just get a different client.
    – Nick
    Aug 30 '17 at 3:01
  • that's why my question is to prevent users from copying files to C: drive. I have putty installed on the VMs and set proper permission to allow only administrators to execute it. But what if a smart user copy putty.exe from somewhere else?
    – JasonL
    Aug 30 '17 at 4:39
  • I don't believe you can restrict "copy" as opposed to "write" - even if you did, the user can still download an executable file. Restricting PuTTY, or other terminal clients, is likely not the answer to your goal. Not sure what you are afraid the user might do using PuTTY; perhaps you need to focus on patching that potential vulnerability (i.e. at the server-side where PuTTY is connecting to) rather than try to prevent copy/execute.
    – Nick
    Aug 30 '17 at 13:10
  • i know, however this not a perfect world. Thanks, anyway:)
    – JasonL
    Aug 31 '17 at 12:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.