I would like to follow this guide to lockdown a machine by blocking the execution of binary files for a specific user via a group policy in the MMC like so: https://blog.brankovucinec.com/2014/10/24/use-software-restriction-policies-to-block-viruses-and-malware/

However, I have been unable to set the path recursively so far, which is a problem, as the user only has to unpack an e-mail attachment into its own directory to be able to execute a file. It's not feasible to include every possible subfolder.

The guide doesn't address this issue. Is there any way to specify the path including all subfolders?

  • In case you don't get an answer quickly, have you looked on the Spiceworks forum?
    – JW0914
    Commented Nov 19, 2019 at 21:36
  • "as the user only has to unpack an e-mail attachment into its own directory to be able to execute a file." - The link you provided indicated that %AppData%\*\*.exe would block the executable in any subfolder within %AppData%. It might be easier to configure which executable the user CAN run, and then disallow any executable, that isn't one of those.
    – Ramhound
    Commented Nov 19, 2019 at 22:08
  • @Ramhound, actually, I haven't been able to reproduce this, however, I am certain that this approach will only affect direct subfolders, if anything, meaning it will block %APPDATA%\a\ and %APPDATA%\b\, but not %APPDATA%\a\c\, so it's ineffective against newly created folders. Commented Nov 19, 2019 at 22:42
  • @Prototype700 - It is trivial to prevent a user from creating new folders in the %AppData% directory. If you have not been able to reproduce your issue, what exactly is your question, I am confused by your last statement.
    – Ramhound
    Commented Nov 19, 2019 at 22:46
  • @Ramhound, in this particular case, it's actually not (only) the %APPDATA% directory that should be prevented running executables from, but a whole partition tree (D:). The user keeps downloads and documents there. He/she can't and should not be prevented from creating subfolders on the partition, because files need to be managed, however they should not be able to execute binary files (at all) there. The C:\ drive access is already restricted, so that is the only place they could (accidentally) run malicious binaries from. Commented Nov 19, 2019 at 22:52


You must log in to answer this question.