Disallow executable file creation

[Rodrigo Lopez Negrete]

Hello,

I'm working for a school's computer lab, and I have a problem with
users that have been creating executable files by downloading
*.(exe,com,vbs,etc), or creating batch files (*.bat). I want to
disallow this if possible so they stop installing software, such as
google talk that doesn't use the microsoft installer. The computers
have Windows XP Professional, and we do not have a domain or WinServer,
therefore all policies will be local. Is this possible without
installing some other software?

Thanks all,
Rodrigo

 

[Steven L Umbach]

You can do that with Software Restriction Policies that can be accessed via
Local Security Policy. For that to be effective the users must not be local
administrators or they can undo restrictions if they know how to and want
to. You also may want to look at the free Shared Computer Toolkit that is
excellent at restricting user accounts and uses Software Restriction Policy
though in a generic way. The links below explain more and FYI by default
shortcuts such as those on the desktop are considered as restricted by SRP
and allowances need to be made for such in your hash/path rules or file
types considered restricted. --- Steve

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx
--- SRP
http://www.microsoft.com/windowsxp/sharedaccess/overview.mspx --- Shared
Computer Toolkit which requires SP2

 

[Rodrigo Lopez Negrete]

Hey Steve,

Thanks for the answer! As it seems the best solution for me was the
Shared Computer Toolkit.

Thanks again..