Limit WSH to a particular folder?

[Gordon Price]

Is there a way to limit WSH to executing scripts from a particular folder
only, and ideally manage this with GP over the domain? Seems like a good way
to make use of scripts while also minimizing script based virus risk.

Thanks,
Gordon

 

[Larry(LJL269)]

Dont know but Symantec has app to turn them ON/OFF at
will but Globally. $0 too. URL by request.

HTH - Larry

On Mon, 13 Oct 2003 08:54:32 -0700, "Gordon Price"

|Is there a way to limit WSH to executing scripts from a particular folder
|only, and ideally manage this with GP over the domain? Seems like a good way
|to make use of scripts while also minimizing script based virus risk.
|
|Thanks,
|Gordon
|


Any advice given is my attempt to show appreciation for all
the excellent help I've received here but I'm no MVP so it
may only apply NUGS. Personal attacks, nitpicking & criticism
of anything but content will NOT be responded to. Those
posters should spend their time taking the test @
http://www.nimh.nih.gov/publicat/ocdtrt1.htm

 

[Larry(LJL269)]

On Mon, 13 Oct 2003 08:54:32 -0700, "Gordon Price"

|Is there a way to limit WSH to executing scripts from a particular folder
|only, and ideally manage this with GP over the domain? Seems like a good way
|to make use of scripts while also minimizing script based virus risk.
|
|Thanks,
|Gordon
|
Its at
http://securityresponse.symantec.com/avcenter/venc/data/win.script.hosting.html

Any advice given is my attempt to show appreciation for all
the excellent help I've received here but I'm no MVP so it
may only apply NUGS. Personal attacks, nitpicking & criticism
of anything but content will NOT be responded to. Those
posters should spend their time taking the test @
http://www.nimh.nih.gov/publicat/ocdtrt1.htm

 

[Gordon Price]

Dont know but Symantec has app to turn them ON/OFF at
will but Globally. $0 too. URL by request.

In this case I don't want to turn them off. Ideally I would like to put all
my scripts in a folder and make that the only place scripts can execute
from. Much less expensive, and a lot easier, than buying a certificate and
signing all my scripts. As for simply turning them off, I think WSH has a
registry setting to either allow execution, allow with warning, or disallow.
I could go that route but that would annoy users and most wouldn't know what
to allow and what not to.

Best,
Gordon

 

[Torgeir Bakken (MVP)]

Is there a way to limit WSH to executing scripts from a particular folder
only, and ideally manage this with GP over the domain? Seems like a good way
to make use of scripts while also minimizing script based virus risk.

Hi

Yes, if you sign your scripts with a certificate.

The Scripting Clinic article context is XP but also applies to systems
running WSH 5.6...

Providing a Secure eXPerience
http://msdn.microsoft.com/library/en-us/dnclinic/html/scripting10082001.asp

Windows Script Host 5.6 (see section "Authentication/Security Advances")
http://msdn.microsoft.com/library/en-us/dnclinic/html/scripting11132000.asp


And related newsgroup threads...

Google Search: TrustPolicy group:*.scripting
http://groups.google.com/groups?q=TrustPolicy group:*.scripting&num=100&scoring=d