?
Solved

Group Policy to prevent users from downloading files

Posted on 2005-05-11
14
Medium Priority
?
1,193 Views
Last Modified: 2008-02-01
Is there a way to prevent users from downloading files to their PC by using Group Policy?

There is an option in Internet Explorer to prevent downloading files. This is located at Tools > Internet Options > Security, then click on Custom Level and scroll to Downloads. The option is File Download. Selecting Disable seems to prevent the user from downloading files. I was wondering if this option can be set to Disabled from the GP
0
Comment
Question by:alank2
  • 5
  • 5
  • 3
  • +1
14 Comments
 
LVL 16

Expert Comment

by:Joe
ID: 13980561
You can in

USER>Administrative Templates> Windows Components> Internet Explorer> Internet Control Panel> Security Page> Locked Down Local Machine Zone> You will see the Policy in there Allow File Downloads.

Joe

0
 

Author Comment

by:alank2
ID: 13980714
On the server, under Active Directory Users and Computers, I have an OU with a GP associated with it. Navigating to the Internet Control Panel in the GP I do not have a Security Page option. All that appears are a series of options to disable pages (general, content, security, etc.). Where am I doing wrong?
0
 
LVL 13

Expert Comment

by:2hype
ID: 13981003
Go to user configuration -- Windows Settings -- Internet Explorer Maintence -- Security.
Click Security Zones and Content Ratings
Under security zones and Privacy -- click import the  current security zones and privacy settings.  Click Modify Settings
Highlight Internet and click custom level
Scroll down to Download -- File Downloads -- Select Disable
Click OK
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
LVL 16

Expert Comment

by:Joe
ID: 13981124
You would have to do this with a machine with XP SP2 on it with the windows server 2003 administration tools pack on it. Here is the link to download the admin pack from Microsoft. This gives you extra GPO options. I am assuming you are running windows server 2000 right?

http://www.microsoft.com/downloads/details.aspx?FamilyID=c16ae515-c8f4-47ef-a1e4-a8dcbacff8e3&displaylang=en


I hope this helps

Joe
0
 

Author Comment

by:alank2
ID: 13981320
We have both W2K (SP4) and WXP (SP1/SP2) clients and need to manage them from a W2K server. As for the instructions from 2hype, will this apply to a GP that we can move clients into? Please explain what this does?
0
 
LVL 16

Assisted Solution

by:Joe
Joe earned 500 total points
ID: 13981392
The admin pack allows you to Administrate your windows 2000 server from a windows XP machine with SP2. This will give you more group policy options.

Joe
0
 
LVL 13

Expert Comment

by:2hype
ID: 13981751
If you want all the new policy options that are in windows xp to show up on your Server 2000 Policy Screen you need to update your policy admin templates.

On a Windows XP Machine migrate to C:\Windows\inf  -- Arrange the files by type.  You will see around 7 .adm files.  These are the updated .adm templates you will need to copy to your server 2000.  Copy the .adm templates to the servers C:\Winnt\INF files.  Overwrite the existing files.  You will now have the updated templates and you will see all the policies you are capable of having in Windows XP SP2.


This above will allow you to administer policys from the server rather than haveing to go the to XP machine with the administrator pack installed
0
 

Author Comment

by:alank2
ID: 13987997
Replaced the templates, created organization unit and moved a user account into the OU. Edited the poicy associated with the OU and found the new IE settings. Disabled downloads from the Internet Zone. Logged on to a PC using the user account which was moved to the new OU, refreshed the policy from the local PC using gpupdate /force and checked the settings in IE at the Internet zone and found the download setting was not set to disabled.
0
 
LVL 13

Accepted Solution

by:
2hype earned 500 total points
ID: 13988026
Go back to the policy and ensure that it File Downloads is set to Disabled.  
0
 

Author Comment

by:alank2
ID: 13989763
Checked policy on W2K server under User Configuration > Administrative Templates > Windows Componets > Internet Explorer > Internet Control Panel > Security Page > Internet Zone. Set Allow File Downloads to Disabled. Checked the PC, File Downloads are Enabled.
0
 
LVL 16

Expert Comment

by:Joe
ID: 13995258
Did you have your group policy working ok before you updated the ADM files?
0
 

Author Comment

by:alank2
ID: 13995318
Yes, all that I use is the Default Domain Policy which has the password information set. I have not ever done anything other than that.
0
 
LVL 16

Expert Comment

by:Joe
ID: 13996729
Maybe you have something in your Default domain Policy overriding other GPO Settings.
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As the title indicates, I have done this before. It chills me everytime I update the OS on my phone, (http://www.experts-exchange.com/articles/18084/Upgrading-to-Android-5-0-Lollipop.html) because one time I did this and I essentially had a bricked …
In this article we will discuss all things related to StageFright bug, the most vulnerable bug of android devices.
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.
Suggested Courses

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question