M
Marc Krikke
Hello.
I started working for a small company with about 40 users.
I created a full new windows environment with windows server 2016 and all new computer with Windows 10 Pro.
Now i'm working on the group policies ..... I can do all I want but have problems with one thing.
Blocking Portable Apps and the Windows Store.
I removed all games from windows and have a clean windows 10 pro install. I work with roaming profiles and redirecting folders. They are NO admin on the computer so they can not install programs.
BUT .. I want to block those portable apps.
With GPO I can block specific programs, like TeamviewerQS.exe, but if they rename it, or a second donwload makes it TeamviewerQS(1).exe it will run so that not a real option.
Then you have applocker ... but that only works with Windows 10 Enterprise.
Then there is a GPO.
UC/Policies/Windows Settings/Security Settings/Software Restriction Policies/Security Levels ....
You can block all and make exceptions ...... but this blocks all and I can't add exceptions anywhere, and also it looks like it's to much to add ....
Is there a way to block programs, or atleas ask admin user to start?
Then there is the Store. I don't want them to use it, or install anything without our approval. How can I do that?
If want to block all Store access that's fine with me 2. If not via GPO is there a way to blcok it on the firewall ....
Any tips for me?
Continue reading...
I started working for a small company with about 40 users.
I created a full new windows environment with windows server 2016 and all new computer with Windows 10 Pro.
Now i'm working on the group policies ..... I can do all I want but have problems with one thing.
Blocking Portable Apps and the Windows Store.
I removed all games from windows and have a clean windows 10 pro install. I work with roaming profiles and redirecting folders. They are NO admin on the computer so they can not install programs.
BUT .. I want to block those portable apps.
With GPO I can block specific programs, like TeamviewerQS.exe, but if they rename it, or a second donwload makes it TeamviewerQS(1).exe it will run so that not a real option.
Then you have applocker ... but that only works with Windows 10 Enterprise.
Then there is a GPO.
UC/Policies/Windows Settings/Security Settings/Software Restriction Policies/Security Levels ....
You can block all and make exceptions ...... but this blocks all and I can't add exceptions anywhere, and also it looks like it's to much to add ....
Is there a way to block programs, or atleas ask admin user to start?
Then there is the Store. I don't want them to use it, or install anything without our approval. How can I do that?
If want to block all Store access that's fine with me 2. If not via GPO is there a way to blcok it on the firewall ....
Any tips for me?
Continue reading...