I am currently using GPO (Computer>Windows>Security>Software>Additional) to lock down several file types from running in places like C:\ and %appdata% and %userprofile%. My issue is that certain folders like "Documents" are redirected to shares while "Downloads" are not. Using %userprofile%\*\*.exe I can block executables in "Downloads" (not redirected) but I CANNOT block items in "Desktop" (redirected). I have tried \\profiles\*\Desktop\*.exe but that does not work either. Any Ideas?


You've got it backwards. You should block EXE's from everywhere, except on whitelisted paths.

But to answer your question directly, you will need to specify the redirected path in the rule, not the original path. That's why your rule is not working.

| improve this answer | |
  • The path has variables. I can't create GPOs for 5K users * 4 folders. – user206106 Oct 18 '18 at 21:58
  • More specifically, I need something similar to \\profiles\*\Desktop\*.exe but that works. – user206106 Oct 18 '18 at 21:59
  • You don't need to be that specific. Just block the entire share. – longneck Oct 19 '18 at 12:59
  • There are folders within each user profile that have items that do need to be run including login scripts. That's not a practical solution. – user206106 Oct 19 '18 at 13:26
  • It sounds more like you have an over-complicated setup. Why are you running exe's from user profile folders? – longneck Oct 19 '18 at 13:29

You are using Software Restriction Policies, since it's deprecated in Windows 10 I recommend you to take a look at AppLocker and implement it on a lab environment first.

You'll be able to do what you want with it since it's blocking everything by default, however you can add trusted path/patterns easily.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.