3

Hi I would like users to download any file (as they currently can) - but for executable files (exe/com/pif/scr/bat/ps1), I would like the 'Run' option to be hidden or disabled.

If that is not possible, what's the closest solution to prevent users running a .bat file they downloaded from a webpage on Internet Explorer

The machine isn't on a domain, but we can use gpedit.msc. I tried the Software Restriction Policies, but that only blocks .exe

Many thanks

Improve this question
2
  • 1
    Do they need to be able to run these files from the file explorer after download?
    – Bob
    Aug 2, 2016 at 3:38
  • I'm not sure if this would work but I don't have time to test to confirm it'd allow download but just not execute but something to look into howtogeek.com/howto/6317/…... I know you can also add disallow rules to specific registry keys and I assume you could use wildcards such as *.bat, *.ps1, etc. but here's a similar answer I wrote and you may be able to tweak, test, etc. superuser.com/questions/1100828/…; I just don't have time to test it to verify right now.
    – Vomit IT - Chunky Mess Style
    Aug 2, 2016 at 3:55

3 Answers 3

Reset to default
2
+25

The closest you might be able to get is to block the download of “high risk” file types in Internet Explorer and provide some other method for users to download them.

The block can be accomplished by enabling Group Policy User Configuration → Administrative Templates → Windows Components → Internet Explorer → Internet Control Panel → Security Page → Internet Zone → Show security warning for unsafe files. (The policy must be Enabled, and the option set to Disable.)

See Information about the Attachment Manager in Microsoft Windows for the list of the file types that IE considers “unsafe”. (It includes all the ones you mentioned except .ps1.)

Note that Chromium and Google Chrome also use the Windows Attachment Manager for downloads, so the IE setting will block downloads in those browsers too. I don’t know about Firefox.

Improve this answer
2
  • 2
    PS1 is not blocked because they're not executable, by design, for the sake of security. You have to execute the shell or ISE and run them. Of course you can hack your system to execute them, but then you lose the built in protection. For other executables, this answer leads to the best built in way to handle this, which is GPO enforcing this setting. There are also third party programs which restrict execution of programs through whitelisting or blacklisting, unfortunately, I don't know of any that simply remove the 'run' button from the IE download bar.
    – Jeter-work
    Aug 5, 2016 at 22:31
  • @Xalorous: Good point that the setting needs to be enforced by GPO. I’ve updated the answer to refer to that instead of the Internet Options dialog box. (Not much point if the user can just change the setting back...) OP said “No 3rd party solutions”, so I don’t think what’s requested is achievable.
    – Brian Nixon
    Aug 5, 2016 at 23:41
2

If you are running the Enterprise version of Windows 7, 8/8.1, or 10, you can use AppLocker to configure this policy through the local Group Policy editor (gpedit).

AppLocker is far superior to Software Restriction Policies. Not only can you configure executable rules like with SRP, you can also set policies for MSI installers, scripts (.bat, .vbs, .ps1, etc.) and Windows Universal (.appx) packages. You can also configure allow/deny rules based on paths, file hashes, and publisher/version info in the certificate (if the application/script is signed with one).

The location to configure the policy is in Computer Configuration -> Windows Settings -> Security Settings -> Application Control Policies.

The downside to AppLocker is that it only works on the Enterprise editions of Windows, not the Pro versions. Also, you cannot use AppLocker and Software Restriction policies together.

Here is Microsoft's documentation of the feature. If you have an Enterprise version, it's definitely worth a look. Note, that link references Windows 8/8.1, but it works equally as well in Win7 and Win10.

Improve this answer
1

Internet Explorer: How to block executable files (exe/com/pif/scr/bat/ps1) from being 'Run' on download

One way you could do this would be to restrict or put an explicit Deny on the NTFS ACL permission of Traverse folder / execute file for this user account (or security group they are a member of) on the folder which IE 11 downloads the files that can be executed (e.g. the /Downloads folder).

This way they can download and save to this folder just fine with IE but when they go to execute, they'll get a permission denied, etc. type of a message and be prevented from executing anything from this location.

Add New Explicit Deny Security

Right-click on the folder, select Properties, go to the Security tab, select Advanced, select Add, select Show Advanced Permissions, select Select a principal, type in the username or security group to restrict this access. Once the principal is selected in the Type field drop the value to Deny, and the Applies to field drop that to a value of This folder and file, and then go down to the Advanced Permissions section and check the Traverse folder / execute file and press OK.

enter image description here

Improve this answer
6
  • 1
    This works for EXE and BAT files, but it doesn't seem to have any effect on VBS scripts. (Probably because it's not the file that's being executed, but rather the file is being passed to an interpreter that then executes various things from the data it finds in the file.) The "Run with PowerShell" option for PS1 scripts also doesn't seem to care about not having execute rights.
    – Ben N
    Aug 2, 2016 at 14:38
  • Good idea. But what happens if the user saves the downloaded file elsewhere before clicking Run?
    – I say Reinstate Monica
    Aug 2, 2016 at 14:43
  • @Twisty I understand exactly what you are thinking and I already thought about that too but the question title stated specifically "How to block executable files (exe/com/pif/scr/bat/ps1) from being 'Run' on download" and also "the closest solution to prevent users running a .bat file they downloaded from a webpage on Internet Explorer", so word-for-word as-is, this fits the need. Obviously if they can copy the executable file etc. elsewhere which they have appropriate access it'll execute. But for on download and from a webpage on Internet Explorer is what it is.
    – Vomit IT - Chunky Mess Style
    Aug 2, 2016 at 21:03
  • Well said. Others asking the OP's same question will do well to consider the OP has narrowly defined his requirement and as such may end up with an answer that accomplishes the technical objective without achieving what may be the true intent to restrict execution of downloaded code.
    – I say Reinstate Monica
    Aug 3, 2016 at 11:27
  • For script files you can change the default action to have them open in a text editor. Then to run a script file you have to explicitly can the script interpreter (cscript)
    – Eric Johnson
    Aug 6, 2016 at 0:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .