Group Policy to prevent users from downloading files

Is there a way to prevent users from downloading files to their PC by using Group Policy?

There is an option in Internet Explorer to prevent downloading files. This is located at Tools > Internet Options > Security, then click on Custom Level and scroll to Downloads. The option is File Download. Selecting Disable seems to prevent the user from downloading files. I was wondering if this option can be set to Disabled from the GP
alank2Asked:
Who is Participating?
 
2hypeConnect With a Mentor Commented:
Go back to the policy and ensure that it File Downloads is set to Disabled.  
0
 
JoeCommented:
You can in

USER>Administrative Templates> Windows Components> Internet Explorer> Internet Control Panel> Security Page> Locked Down Local Machine Zone> You will see the Policy in there Allow File Downloads.

Joe

0
 
alank2Author Commented:
On the server, under Active Directory Users and Computers, I have an OU with a GP associated with it. Navigating to the Internet Control Panel in the GP I do not have a Security Page option. All that appears are a series of options to disable pages (general, content, security, etc.). Where am I doing wrong?
0
Cloud Class® Course: SQL Server Core 2016

This course will introduce you to SQL Server Core 2016, as well as teach you about SSMS, data tools, installation, server configuration, using Management Studio, and writing and executing queries.

 
2hypeCommented:
Go to user configuration -- Windows Settings -- Internet Explorer Maintence -- Security.
Click Security Zones and Content Ratings
Under security zones and Privacy -- click import the  current security zones and privacy settings.  Click Modify Settings
Highlight Internet and click custom level
Scroll down to Download -- File Downloads -- Select Disable
Click OK
0
 
JoeCommented:
You would have to do this with a machine with XP SP2 on it with the windows server 2003 administration tools pack on it. Here is the link to download the admin pack from Microsoft. This gives you extra GPO options. I am assuming you are running windows server 2000 right?

http://www.microsoft.com/downloads/details.aspx?FamilyID=c16ae515-c8f4-47ef-a1e4-a8dcbacff8e3&displaylang=en


I hope this helps

Joe
0
 
alank2Author Commented:
We have both W2K (SP4) and WXP (SP1/SP2) clients and need to manage them from a W2K server. As for the instructions from 2hype, will this apply to a GP that we can move clients into? Please explain what this does?
0
 
JoeConnect With a Mentor Commented:
The admin pack allows you to Administrate your windows 2000 server from a windows XP machine with SP2. This will give you more group policy options.

Joe
0
 
2hypeCommented:
If you want all the new policy options that are in windows xp to show up on your Server 2000 Policy Screen you need to update your policy admin templates.

On a Windows XP Machine migrate to C:\Windows\inf  -- Arrange the files by type.  You will see around 7 .adm files.  These are the updated .adm templates you will need to copy to your server 2000.  Copy the .adm templates to the servers C:\Winnt\INF files.  Overwrite the existing files.  You will now have the updated templates and you will see all the policies you are capable of having in Windows XP SP2.


This above will allow you to administer policys from the server rather than haveing to go the to XP machine with the administrator pack installed
0
 
alank2Author Commented:
Replaced the templates, created organization unit and moved a user account into the OU. Edited the poicy associated with the OU and found the new IE settings. Disabled downloads from the Internet Zone. Logged on to a PC using the user account which was moved to the new OU, refreshed the policy from the local PC using gpupdate /force and checked the settings in IE at the Internet zone and found the download setting was not set to disabled.
0
 
alank2Author Commented:
Checked policy on W2K server under User Configuration > Administrative Templates > Windows Componets > Internet Explorer > Internet Control Panel > Security Page > Internet Zone. Set Allow File Downloads to Disabled. Checked the PC, File Downloads are Enabled.
0
 
JoeCommented:
Did you have your group policy working ok before you updated the ADM files?
0
 
alank2Author Commented:
Yes, all that I use is the Default Domain Policy which has the password information set. I have not ever done anything other than that.
0
 
JoeCommented:
Maybe you have something in your Default domain Policy overriding other GPO Settings.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.