How can I stop .exe's being ran from removeable media, such as USB drives?
I have an issue with users running .exe's from removable storage such as Memory Sticks and SD cards.
I am trying to set up blocking of exe's being ran from all removable storage to combat this, however under the Group Policy settings under "User Configuration > Windows Settings > Security Settings > Software Restriction Policies > Additional Rules" you can create a "path" variable. I would like to use a system variable for all removable storage but do not know if there is one that works. Do I have to go through and create a blocklist for all potential drive letters that could be assigned to removeable media (E:\ through to about L:\) or is there one that actually works? I've found %~dp0 which, apparently, only works for for loops, if statements and batch parameters.
If there are other, better, or more reliable measures please let me know.
Oh, I've looked at AppLocker but our DC is running Server 2008 and I believe that AppLocker is part of Windows 7 and 2008 R2. As mentioned in the comments to the answer below I don't think Server 2008 has the "Deny Execute Access" setting, so are there any other options?
Solution 1:
You can stop execution of software on removable devices via a GPO. The setting is under Computer > Administrative Templates > System > Removable Storage Access > Removable Disks: Deny Execute Access
Edit:
Do you have access to a Server 2008 R2 System? If so, you could create the policy setting, back it up to disk and transfer it to your Server 2008 System and import the policy back. This won't give you the ability to modify the policy, but you should be able to see the settings as Extra Registry Settings and it should work fine on your Windows 7 clients.
If it helps, I've just created a backup of such a policy, and have put it up on Dropbox for you to download. The usual use at your own risk, etc. applies.
Solution 2:
Some corporate anti-virus products (e.g. McAfee, Sophos, Symantec) include this function as something that can be enabled corporately. Maybe your corporate anti-virus solution has this as a feature.