1

I want to make my system unable to launch .scr .pif (and all executable windows formats here) as a executable program. How do I disable them an make .exe files only runnable as programs (and .msi & .bat ofcourse shall remain possible to launch).

6
  • If you might need a list of all extensions to answer this question, please reffer here: pcsupport.about.com/od/tipstricks/a/execfileext.htm
    – Gizmo
    May 21, 2015 at 17:37
  • 2
    Did you try deleting HKCR\.scr (and same for the others) from the registry?
    – Karan
    May 21, 2015 at 17:37
  • ah that seems to work!
    – Gizmo
    May 21, 2015 at 17:38
  • Please use that as the answer :) (and remember to tell users to backup their registry)
    – Gizmo
    May 21, 2015 at 18:10
  • Edit: hm this doesn't disable command line from running it, only explorer :(
    – Gizmo
    May 21, 2015 at 18:15

2 Answers 2

2

You can Software Restriction Policies: https://technet.microsoft.com/en-us/library/bb457006.aspx

Software Restriction Policie

How ever, nothing prevents user from renaming file. You may also try AppLocker (https://technet.microsoft.com/en-us/library/ee424371(v=ws.10).aspx) which is more powerful than SRP, but renaming is still possible.

1
  • +1 This is the proper way of setting up a security policy but as you said, unless all executable file types are disallowed it would be trivial to rename the SCR as an EXE and run it.
    – Karan
    May 21, 2015 at 18:42
0

Although Karan's comment to your post about removing HKCR\.scr will work, it is easy to bypass. All one would have to do is rename mystify.scr to mystify.exe and it will run. FYI, Windows screensavers are really just .exe executable files.

The only real way to stop executables (like .exe) from running, is to disable the Read & Execute permission from the security tab on it's file properties. This can be modified by user or group.

2
  • most maliscious programs use extensions like .pif and .scr, .com, etc.. I would like only .exe's and .msi to be launchable system-wide (even if a user doesn't purposefully launch a file)
    – Gizmo
    May 21, 2015 at 18:24
  • 2
    @Gizmo - But those users can still rename the files. I can't say not allowing this extensions isn't a good idea but easily bypassed and only protects you from a small subset of the threats. Easier to setup up your domain, so any executable downloaded, cannot be executed or better yet block it at your firewall.
    – Ramhound
    May 21, 2015 at 18:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .