I want to make my system unable to launch .scr .pif (and all executable windows formats here) as a executable program. How do I disable them an make .exe files only runnable as programs (and .msi & .bat ofcourse shall remain possible to launch).
2 Answers
You can Software Restriction Policies: https://technet.microsoft.com/en-us/library/bb457006.aspx
How ever, nothing prevents user from renaming file. You may also try AppLocker (https://technet.microsoft.com/en-us/library/ee424371(v=ws.10).aspx) which is more powerful than SRP, but renaming is still possible.
-
+1 This is the proper way of setting up a security policy but as you said, unless all executable file types are disallowed it would be trivial to rename the SCR as an EXE and run it.– KaranMay 21, 2015 at 18:42
Although Karan's comment to your post about removing HKCR\.scr
will work, it is easy to bypass. All one would have to do is rename mystify.scr
to mystify.exe
and it will run. FYI, Windows screensavers are really just .exe
executable files.
The only real way to stop executables (like .exe) from running, is to disable the Read & Execute
permission from the security tab on it's file properties. This can be modified by user or group.
-
most maliscious programs use extensions like .pif and .scr, .com, etc.. I would like only .exe's and .msi to be launchable system-wide (even if a user doesn't purposefully launch a file)– GizmoMay 21, 2015 at 18:24
-
2@Gizmo - But those users can still rename the files. I can't say not allowing this extensions isn't a good idea but easily bypassed and only protects you from a small subset of the threats. Easier to setup up your domain, so any executable downloaded, cannot be executed or better yet block it at your firewall.– RamhoundMay 21, 2015 at 18:35
HKCR\.scr
(and same for the others) from the registry?