I need to disable a users ability to download certain (or any kind) files using IE. Can this be done?

censor the ports. discipline the students. a privilege is not a right, abuse it and lose it.

Depending on needs, why let them have write access at all? (Why let them download at all?) Workaround - give them only a little space to write in, if they use it up, abuse it, then they are out (at least of space)

For port censorship, you should first block all ports, then only enable the exact ones you know you need, such as port 80 for html/web

> within IE, or through a croup policy

remember, IE is general browser, Win9x as well, so NT = OS is not so involved with its internals.

You can configure IE to just not trust the internet, for any downloads. Who needs them anyway?

most said above ..

woodsman707, what dou want to prevent? execution of such programs, connecting to internet with such programs, or just downloading any *.exe

What is your internet connection based on?? is it a router? or firewall? if it is a firewall just block the IP address's for those services.  Setup a deny to them.

Ok, so I can set up IE to disaloow downloads, but still allow access to the internet based on group membership, or based on a profile?

Using Microsoft Proxy Server 2 (2 actually, one on my site and one in the parent domain), also behind a Pix firewall  (I believe) that I have no access to.

Thanks guys, any help is hugely appreciated, as I am swamped and don't get a lot of time to research this type of stuff as much as I would like.

Justin

SunBow's comment about discipline is right on. YOU are responsible for the activities on your network. Disable the account for a month. Kick out of school, whatever. Be merciless and stick to it. YOU can go to jail. Use logs to find the culprits. Make them write 5000 words essay on why piracy is wrong.
Sorry but you touched a sensitive spot. They're playing with the food on your table, don't forget that.

Thanks everyone,

I cannot describe to you how difficult it is to be in my position, because I cannot set policy, i can only inforce it. You have to remember that this is a high school, not a corporation, and I have 130 to 140 teachers, who all think they are the most important person, or that they teach the most important class, and 2600 students.

There is too much work for one person, but unfortunately, I'm all they can afford. I have made great strides already, but with huge resistance from the powers that be (politics and teachers).

I cannot approach it from the perspective that Sunbow mentions, I've tried that (accountability, restrict access), but this is public school, so if a kid needs a pencil, we have to supply it, and if a kid is in a class that requires PC access, he/she gets it. It also really sucks that a lot of the teachers don't manage the PCs that are in their rooms. In any event, we are covering ground that is already covered. I told a teacher that I foind downloaded games on his machines, his answer: "They are easy to uninstal". Missing the point entirely...
All ports are blocked except 80 for http. I am not that familiar with Proxy server, and the person who was here before me was good with PCs, but horrible at network administration, so things are pretty screwed up.

I appreciate the assistance, maybe this gives you a clearer picture about where I am.

Thanks,

Justin

If you have a PIX firewall, shutting down Kazaa is fairly simple, just block TCP port 1214 both directions. Same with Gnutella, just block the ports.

Preventing .zip, .exe downloads from web sites is extremely difficult without some type of content filter. I don't think Proxy server will do this for you. If you can get the funding, Websense is really the way to go. It works hand-in-hand with your PIX firewall.

See me answer  this article http://www.experts-exchange.com/Security/Q_20598395.html. Users cant install most of the software they downloaded. Of cause not self running .exe files or software which runs without installation.

woodsman707, still missing an answer to my more detailed question ...

Sorry ahoffman,

I want to prevent the downloading and installation of any exe, and the downloading of any type of file, except .pdf, and other such documents.

Justin

I agree with lmoore, like I posted earlier, just block the ports and or IP address on your firewalll. its a lot less work then getting into proxy servers and IE ........

zekker,

Here is the actual response from our lead LAN manager when I asked to block 1214 in both directions, "some teachers have made a case for downloading uncopywritten material from the net, it isn't worth the fight"

I need a solution...or soon, hair transplants :)

Sounds like you have your hands full.!!

>some teachers have made a case for downloading uncopywritten material from the net
These teachers are setting a fine example for their young charges. This is the most ridiculous excuse I've seen for keeping the Kazaa ports open, when this is the only application that uses this particular port.

>it isn't worth the fight
If you can't beat them, join them.

You could ask if they have a legal defense fund?  because it seems that according to this artical ......  that may be something they might look at setting up.

http://sg.news.yahoo.com/030429/3/3akqc.html

So when the school gets its legal notice :)  you can wave that artical around  ;)

I give up, thanks for all you help guys.

Justin

I know this comment is more than a day late and more than a dollar short, but for whatever it's worth... :-)

What OS are the individual workstations running?  If it is NT, or 2000, or XP Pro, you can set up the user policies so that installing new software is prohibited.  

Users who are part of your "power users" group (or higher authority) could still be permitted to install software.

If you can accomplish this, you'll still have to go from machine to machine and clean off KaZaa and other offending items.

Of course, even if you can do this, you still have to have someone in your organization backing you up with policy.

If you have nothing backing you up (policy, or an authority figure who is your "sponsor"), then you should seriously consider dusting off the old resume and beginning a job search in your off-time.  Expert 'esmogen' is right: you can end up being held responsible for the irresponsibility of others.  Don't allow others to put you in an untenable position.  (But -- in this economy -- don't leap off the ship until you have a solid offer to go to!)

Maybe a principled departure will cause the others to wake up?

Oh, hey, I *did* think of one other possibility...

Where is the PIX firewall located?  You said you don't have access to it, and I assumed this meant "logical access."

If it is NOT located onsite (i.e. maybe you have someplace where several schools have their networking concentrated before being passed onto the internet), then you *might* try the following tactic:

Get a cheap appliance firewall and put it at your school's access/egress point!  (Or, if you can't get the $400-600 but you have a spare PC, then build out an OpenBSD box and run an Open Source firewall.)

(Once again assuming the PIX is not onsite and protects more than just YOUR school...)  Your justification to your local school's administration is that you need to guard against malicious hackers with access from other schools.

Now, you'd have a firewall YOU control (inside the PIX firewall's boundaries).  And you could set your little internal firewall to be able to block the ports YOU want to, and to filter or strip whatever you desire.


Hope this helps!!

I've never seen a policy which can restrict downloading and running software on any M$ mashine, except disabling write-access.
Ok, the policy can setup to allow only some executables. The question is if somebody still have got it working with such restrictions.
I also can't imagine of a firewall which prevents downloading. If you want something like that it's a adaptive, or application level, firewall which needs to parse the traffic completetly, even the encrypted one (on port 443). And most people even know how to use anonymous https proxies ...

As I was envisioning it, the policy could be set up to disallow most of the automatic installers, but you're right, you cannot totally prevent the user from transferring an .EXE onto the machine and executing it.

I can certainly envision something more elaborate that would get a litter closer... for example, if all workstations are using NTFS, then only allowing programs to be executed from certain directories where you have disabled write access (if I am remembering NTFS permissions correctly, that is).  But "more elaborate" also would mean "more time consuming to administrate."  :-(  So such a scheme might not be practical.

I can't think of a way to *really* prevent someone from using an offsite anon proxy.  Last time I checked, HS kids didn't know about those; guess the kids have now outrun us?

And yes, adaptive application level packet filtering was part of what I had in mind.  Besides the obvious of blocking things like the KaZaa ports.  Guess I'll have to dig out my old Microsoft Proxy Server 2 documentation to see what's possible there and how to do it.

I went back and re-read the thread, and noticed that I had really mentally glossed over the part about preventing ANYTHING from being downloaded.... nope, cannot imagine how to lock it down THAT tightly.  So you're absolutely right, he's stuck.

I'm a comsultant to a number of public libraries. We have a ver similar desire to stop the patrons from downloading, etc.

My suggestion is to investigate the Opera Browser instead of IE. In version 6.05 you can set up a kiosk mode and with command line switches you can stop all downloading. It also can be set to refuse pop-ups, prevent tinkering with the settings, delete all history, etc.

Version 7 of Opera is now available but it doesn't have the kiosk features yet.

Bill

P.S. Opera's original claim to fame was that it is faster than IE or any other browser for that matter. It still is!

hmm, Opera, Mozilla can stop download and popups and much more ...
but how if the .exe is "hidden" as a .html? or the content-type is *not* "text/html" but any kind of "stream", then you get the .EXE in your browser and simply save it.

There're infinite ways to get it, if you know how.
Restrict write to disk/floppy, or you're lost in nowhere ..

The last few comments were a slight help, but unfortunaltely, the school district cannot buy hardware, we're in a deficit-to the point where they are closing schools and laying people off left and right. I'm migrating all the PCs to either XP (less than 20) or Windows 2000 (460 PCs), and need a centrally administatable browser. I've been told that I cannot block floppy/CD drive access. I can use ghost to get an image out to all the PCs, but I need it to be flixible, because so many different classes require access to different things. For example, I have a yearbook, web design, and student government group that require special access. That does'nt even include the teachers who have been there for 25 years, and think that their way is the only way. The only option I can see, is to give people enough rope to hang themselves. Meaning, If they want less restrictive access, then they'll have to deal with the crashed, slow PCs.I won't have time. We'll see how it goes. I may have to take a crash course in Linux and build a really simple box to run a Linux based firewall.

Thanks,

Justin

> .. we're in a deficit-to ..
.. and then bying XP or w2k? strange, very strange ...

> The only option I can see, is to give people enough rope to hang themselves.
> Meaning, If they want less restrictive access, then they'll have to deal with the crashed, slow PCs.

Managed correctly (maintaining a paper trail so that you cover your "6 o'clock"), this can be very effective.

> I may have to take a crash course in Linux and build a
> really simple box to run a Linux based firewall.

If you're going to do the crash course and build an OpenSource firewall, consider using OpenBSD or FreeBSD.  IMHO, they are more stable and more secure than any of the Linux distributions.

PS: I like Opera too!  I run Opera-6 on all my machines at work and at home, and recommend it to all my clients.  Faster, more attractive (lots of free downloadable "skins"), more configurable, more privacy-friendly... and it doesn't come from Micro$oft.  :-)