China DOS Union

Can't find relevant content in the forum and GOOGL. Please help. There are several programs under the C drive. I want to prohibit them from running through the hash rule in the software restriction policy of group policy. Because creating a new rule involves the selection of these several files, I don't know if batch processing can be used to realize creating the hash rules of these several programs.

[ Last edited by HAT on 2009-1-13 at 23:33 ]

Search for the Windows security guide. There is a Group Policy called secedit that updates the system policy by refreshing the policy template. Unfortunately, I still don't know how to generate the policy template.

Now we are also using Symantec SEP, which is not bad

This is also one of the problems I want to solve, give it a thumbs up

I have used two methods to prohibit the operation of specified programs, not the hash rules. Method 2 can be referred to. Generally, if there is no prompt, most people don't know what's going on...

Method 1: Group Policy (can specify running or specify prohibiting running)
The function of disabling programs in Group Policy: Run the "gpedit.msc" command to open the Group Policy console, expand "User Configuration - Administrative Templates - System" in it,
The policies of "Only allow running licensed Windows applications" and "Do not run specified Windows programs" on the right can help you a lot.
When the user tries to run an unallowed program, a dialog box of "......The restriction is canceled. Please contact the system administrator." will pop up.

Method 2: Image hijacking
For example, running QQ actually starts ctfmon, and the system will have no prompt.
You can also consider starting a VBS or BAT to perform password verification before running the specified program.
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qq.exe" /v debugger /t reg_sz /d "C:\WINDOWS\system32\ctfmon.exe" /f

[ Last edited by exzzz on 2009-1-12 at 10:19 ]

Found some information

First configure the rules on your own machine, then export the hash rules:
Show system files, show all files. Copy out C:\WINDOWS\system32\GroupPolicy\gpt.ini by directory
c:\WINDOWS\system32\GroupPolicy\Machine\Registry.pol

And overwrite the above files to the target machine... You can test it, I have no place to test

First, manually configure the programs and paths (not allowed) or the programs running under the specified paths (not restricted) on your own machine. Then copy the Registry.pol file. If you need to configure on other machines, copy the Registry.pol file over. If you want to remove all settings, just delete the Registry.pol file.

If you really want to be completely automatic, consider the following ideas:
1. Use VBS or BAT to read the "block list" and write it into variables, mainly the full program path.
2. Use VBS's sendkeys to simulate keyboard operations to GPEDIT.MSC to add these variables.
3. VBS or bat copies the local Registry.pol and remotely logs in to overwrite the files of the target machine.

Thank you very much for the guidance from exzzz and ZJHJ!

The problem has been resolved. The policy file of the system is indeed the Registry.pol file. After configuring the policy on the server, synchronize the Registry.pol and gpt.ini files to the same directory of the client, and then run gpupdate /force to refresh the group policy.

Not bad, make a mark! ～