Prevent exe execution from temp internet folder

Question

how can i prevent exe excution from temp and internet temp folder. we have antivirus deployed but it does not prevent exe execution from temp folder. I have tried prog trust-no-exe http://www.beyondlogic.org/solutions/trust-no-exe/trust-no-exe.htm but I am having trouble deploying to multiple workstations. a solution that can be deployed with or without group policy will be appreciated.

Thanks

Answer 1

No need to look for a third-party solution. You can setup security policies of this level through Software Restriction Policies. Also described here.

For your case in particular, you want to run secpol.msc. I currently don't have access to Windows XP or Vista. I can't remember the exact details. They shouldn't vary much though. If you are using Windows 7, you want to then navigate to Application Control Policies -> AppLocker -> Executable Rules. You then create a new rule to disable executable execution rights on a certain path.

Answer 2

Not that this is necessarily a concern depending on what you are trying to prevent, but many installers' first action is to decompress files into a user's temp folder before installation. Often these are .msi files, which wouldn't be affected, but it's conceivable that an .exe could be put into the temp folder as part of an installation.

If you don't allow a user to do program installation then this wouldn't be an issue, but it's something that might need to be taken into account.