Announcement

Collapse
No announcement yet.

GPO to deny save certain file types

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • GPO to deny save certain file types

    Hello,

    I need your help, pls.

    I want to keep the users in the domain (win2003 DC) from saving different file type, like *.avi and *.mp3.
    Any ideea on how to make a automated search on the domain computers for these file type even if they are saved without an extension.

    Thanks.

  • #2
    Re: GPO to deny save certain file types

    Hi auretu,

    You can implement a Software Restriction Policy from GP and in the details pane
    "Object Types" select Designated Files type and there you can select certain file type extensions to be allowed/disallowed or you can customize it by adding your own file extensions.

    I hope this will help you.

    Regards,

    Calin Irimies
    Regards,
    Calin Irimies

    Comment


    • #3
      Re: GPO to deny save certain file types

      Originally posted by calinx
      You can implement a Software Restriction Policy from GP and in the details pane
      "Object Types" select Designated Files type and there you can select certain file type extensions to be allowed/disallowed or you can customize it by adding your own file extensions.
      That won't prevent users from saving the files. Software Restriction policy is designed to prevent execution of software. The only thing you can use Software Restrictions for is to prevent users from using those file types.
      http://support.microsoft.com/default...b;en-us;324036
      Regards,
      Jeremy

      Network Consultant/Engineer
      Baltimore - Washington area and beyond
      www.gma-cpa.com

      Comment


      • #4
        Re: GPO to deny save certain file types

        Jeremy is correct. For current versions of Windows, you need to go 3rd party. We use Veritas (Symantec) Storage Exec (formerly known as Storage Central) which is disk quota and file blocking software. It has its share of bugs but for the most part, the software does what it's supposed to.

        Longhorn will have it's own version of file blocking and a better quota management system than what Windows 2000 and 2003 had.

        Jas
        Attached Files
        VCDX3 #34, VCDX4, VCDX5, VCAP4-DCA #14, VCAP4-DCD #35, VCAP5-DCD, VCPx4, vEXPERTx4, MCSEx3, MCSAx2, MCP, CCAx2, A+
        boche.net - VMware Virtualization Evangelist
        My advice has no warranties. Follow at your own risk.

        Comment


        • #5
          Re: GPO to deny save certain file types

          Windows 2003 Server R2 has a neat feature that will allow you to stop users saving selected file extensions. Works a treat!! One thing I didn't like about it was that it worked at the SHARE level and not on OU one. Maybe they will sort that out for Longhorn.

          As for finding the files that have had their extensions changed I have found that while trying to send an email to a friend with an AVI attached, it was blocked by MailMarshall. I tried changing extension name, blocked, zipped with extension changed, zipped, RARed, changed extension and zipped again and it was still blocked. Maybe an email to the nice people at MailMarshall will provide you with the sort of scan you require.
          1 1 was a racehorse.
          2 2 was 1 2.
          1 1 1 1 race 1 day,
          2 2 1 1 2

          Comment


          • #6
            Re: GPO to deny save certain file types

            Thanks everyone.

            You are shure that there's no way I can do it with GPO only.

            I have no budget for a Veritas solution and for shure I can't tell my boss next year to give me $ for a Longhorn Server.

            Comment


            • #7
              Re: GPO to deny save certain file types

              Originally posted by auretu
              Thanks everyone.

              You are shure that there's no way I can do it with GPO only.

              I have no budget for a Veritas solution and for shure I can't tell my boss next year to give me $ for a Longhorn Server.
              You won't be able to prevent users from saving file types without spending some money but you can delete them after the fact with a script. I'm not too good with scripts but a google search will easily find a plethora of options.
              Regards,
              Jeremy

              Network Consultant/Engineer
              Baltimore - Washington area and beyond
              www.gma-cpa.com

              Comment


              • #8
                Re: GPO to deny save certain file types

                I won’t worry about what people saves to there desktop /laptop since these files are virus and spayware free. Don't be so cruel, anybody would like to watch a good movie or listen to music when fed up with work and manager is away
                It is totally different when they save files to a server. But for this situation I can chosse between several solutions to prevent unwanted resources to be stored on the network share.
                One of them is implementing file screening management included in Windows 2003 R2.
                Space Guard from tools4ever can also help.
                Regards,
                Csaba Papp
                MCSA+messaging, MCSE, CCNA
                ...............................
                Remember to give credit where credit is due and leave reputation points where appropriate
                .................................

                Comment

                Working...
                X