hi
how can i disable running of batch files in Windows?
Printable View
hi
how can i disable running of batch files in Windows?
that would depend on what proggie/process is calling the batch files... more information please... what exactly is going on here, and which batch files do you wish to disable?
hi
the situation is this. i have disabled the cmd.exe for users, but they can still create a batch file,
eg
nbtstat -a <ip>
pause
and save it as a batch. eg nbtstat.bat
then they can double click on the batch and the cmd.exe runs.
how can i restrict this?
thanks
As Wiskic~ has said we need to know more.
1. What is your hardware setup.
2. What sort of business environment.
3. Are we talking desktop or server.
4. What operating systems.
5. Is this kind of activity likely, if so, by whom.
I would point out that security is a balanced and layered model approach. Just whacking in a few restrictions is not a satisfactory approach. Do you have a security model; do you have an AUP?
OK, as for the batch files, your FIRST task is to find what you have, what they do and what launches them. Please remember that a lot of sites still use batch files for user logon/logoff. And there are plenty of applications that have retained them historically. Anything launched as "user" would be a potential problem.
You might like to look at limiting access to DOS mode/DOS prompt? or maybe look at third party software, particularly if you have to run obsolete OSes for legacy support or whatever.
Please take a look at this:
http://www.topshareware.com/1st-Secu...nload-6513.htm
I would normally only suggest it in a legacy support situation, as it gives you better control over Win95 (no! you can't be :D ) 98/98SE and ME.
;)
Hi ghostmachine,
You can do this by changing 'Windows File Types' in windows explorer if you have access to the admin account and the users your trying to prevent using batch files do not have access to the admin account.
To do this log in as administor click on a folder such as 'My Documents' at the top of the window then click on the 'Tools' tab then scroll down and click on folder options.
Then click on the tab 'File Types'.
Then click on the 'new' button and a box should pop up saying 'Create New File Extension'.
In this box enter 'bat' then click on 'Advanced' then under where you entered the file extension 'Associated File Type' should say : 'MS-DOS Batch File' then click the 'ok' button.
Now under the 'New' button it should say:
'Details for 'Bat' extension' next to that click on the 'Change' button.
then select a program you want to use to open .BAT extension files with such as 'Notepad' or even 'Paint'.
Then click 'ok' and then 'Close'.
Now go and open a batch file to test this out.
Then if you are logged on to windows with a limited account all the boxes which you clicked on to change what program the file extension opens with are greyed out.
This is more effective on an operating system such as windows xp where it is easier to lock down security you did not say for which version of windows you wanted this for but i hope this helps if not could you please give us more info such as which version of windows.
EDIT: I have just noticed this is account spectific so for the user accounts you want to prevent this on you will need to login to admin make the user accounts you want to prevent this on admin temporarly to get past the greyed out box situaction on limited accounts.
Then do what i said above for each account you want to prevent this on then login to your usual admin account then make the accounts that were previously limited make them limited again.
I can't help but wonder "Why?"... Why would you prevent users from creating and executing batch files? What's the risk? Or even better.. What are you trying to prevent your users from doing?
So you've prevented cmd.exe.... What about command.com? What about a user that just copies cmd.exe and renames it to mycmd.exe?
Thankyou SirDice
Exactly what I was driving at, and you can add hardware security as well, floppy disks, CD/DVDs, thumb drives.......................stuff they send to themselves via e-mail, steganography..................
YoungNobody FYI, this may well not be a simple as you seem to think. Some management utilities and applications may actually run as "user", rather than "system" or a custom ID for the application. You need to check this up front if you don't want to look a total dork ;)
Also, as soon as you stick your head above the parapet and start introducing new security controls you had better make sure that they are part of a well thought out and cohesive model.
:)
say for a simple example, user downloaded netcat (from his home,maybe)Quote:
Originally posted here by SirDice
I can't help but wonder "Why?"... Why would you prevent users from creating and executing batch files? What's the risk? Or even better.. What are you trying to prevent your users from doing?
So you've prevented cmd.exe.... What about command.com? What about a user that just copies cmd.exe and renames it to mycmd.exe?
bring it to office on a USB/floppy/CDROM , insert it and start creating a batch
such as
echo "HEAD / HTTP/1.1\n\n" | nc.exe -vv <IP> ( ok i forgot the exact syntax, roughly it's like this for example)
Then he can double click the batch and it will execute.
AFAIK, netcat can be run on a floppy.
anyway, it's just a simple example of what users can do with batch. (even WSH i want to disable in future)
So i don't want users to do that.
BtW, we have XP users and PDC is running on Win2k server
thanks
nihil,Quote:
Originally posted here by nihil
Thankyou SirDice
Exactly what I was driving at, and you can add hardware security as well, floppy disks, CD/DVDs, thumb drives.......................stuff they send to themselves via e-mail, steganography..................
YoungNobody FYI, this may well not be a simple as you seem to think. Some management utilities and applications may actually run as "user", rather than "system" or a custom ID for the application. You need to check this up front if you don't want to look a total dork ;)
Also, as soon as you stick your head above the parapet and start introducing new security controls you had better make sure that they are part of a well thought out and cohesive model.
:)
I was just about to make another post asking ghostmachine what he is trying to accomplish by disabling access to 'cmd.exe' and preventing users from executing batch files.
I know their are ways around what he is trying to implement but he did ask how to prevent the execution of batch files for his users.
Like i just mentioned above i was just about to repost and ask ghostmachine exacely what hes trying to accomplish so we can answer his question more effectively.
<Off Topic>
nihil, sorry if you have understood me but im the sort of person if someone were to say to me:
"I work for NASA and i need some way of securing the systems i need a free windows software firewall" then i would proberly link them to sygate or zone alarm.
Then i would ask them if thats all they are doing to secure the systems like i was going to ask ghostmachine what he wanted this info for but you beat me to the post.</Off Topic>
EDIT: Sorry this was hard for me to explain and i had mistyped a few things so i had to go back over what i had written to check it and make sure it made sense.
Hi ghostmachine
I do hope you realise that if you allow that, you have a much greater problem than people using Windows functionality, and what you are proposing is futile? Your security model is so flawed, I doubt if anyone would bother to write a batch file to circumvent it.Quote:
say for a simple example, user downloaded netcat (from his home,maybe) bring it to office on a USB/floppy/CDROM , insert it and start creating a batch
Suppose I wander in with a CD/DVD loaded with a bootable distro of some sort.............you are OWNED And all those nice little backdoors, timebombs, keyloggers and stuff that I would load onto your system?
As we are obviously talking about "the enemy within" you MUST blend in physical security and a strong AUP as part of your security model.
You must segment your network to reflect security requirements, and you must only grant users sufficient authority to carry out their functionality as required by the business ;)
nihil,
I understand what you are talking about and i am not trying to p*ss you off but you have still not effectively answered his question.
You have just told him how you can break into his system and how he should be more open minded when it comes to security.
So please tell us...
How can he prevent this?.
Your problem starts here... Everything else is the consequence of this... This is what you should be preventing.. How to prevent it?Quote:
Originally posted here by ghostmachine
say for a simple example, user downloaded netcat (from his home,maybe)
bring it to office on a USB/floppy/CDROM , insert it {....}
1) proxies/content scanners can prevent downloading executable content.
2) rip out floppy and cd-drives..
3) disable Mass Storage devices (memory sticks et al)
No need to create a batch....Quote:
and start creating a batch such as
echo "HEAD / HTTP/1.1\n\n" | nc.exe -vv <IP> ( ok i forgot the exact syntax, roughly it's like this for example)
Then he can double click the batch and it will execute.
What about Start -> Run... ?
What about Taskmanager's File -> Run.. ?
What about WSH, vbs, js?
There's a plethora of different ways to execute it..
Heck, I could even embed it into a html page and have it execute clientside by using javascript..
By doing thisQuote:
How can he prevent this?.
Quote:
As we are obviously talking about "the enemy within" you MUST blend in physical security and a strong AUP as part of your security model.
And have audit and security logging enabled...
Anything that comes at the server or other workstations can be logged..with a time and IP address..
Then you take the little pri#k aside and fire his a$$
MLF
YoungNobody
This was my answer (remember we had no environment details at that point):
It depends on circumstances which have been enquired upon but not supplied. WHO is he trying to stop, and WHAT is he trying to stop them doing.Quote:
You might like to look at limiting access to DOS mode/DOS prompt? or maybe look at third party software, particularly if you have to run obsolete OSes for legacy support or whatever.
I have answered him insofar as to tell him that his question is both trivial and irrelevant whilst people are allowed to walk on site with their own media and upload and run executables. he needs to lock that down, and determine who actually needs to run batch files, before he even thinks about controlling them.
I will reiterate: messing with batch file authority needs to be done with caution as it may have a dramatic effect on functionality. I am talking about the user's ability to do their job............mess with that and you are history............trust me, I have seen it happen, round about 1982 ;)
We are not talking operating system here, we are talking applications. Many of these have been around for a very long time and still have ancient, embedded stuff in them................yes even ASM :D
And to prevent it?....................he needs to develop a balanced security environment and policy. There is NO shortcut that I am aware of.
In fact, I would go as far as to say that messing around with silly little tweaks and not looking at the "big picture" first, is probably more dangerous that doing nothing at all. At least doing nothing does not lull you into a false sense of security?
;)
My stock answer would be to use the domain security policies option in your windows domain to block access to the run option in the start up menu and to block certain file types from being executed. Of course if the users are admin of their machines they can by pass this by creating local user accounts that won't be effected by the domain wide security policy.
Short answer is no, not without 3rd party software.
http://www.beyondlogic.org/solutions...ust-no-exe.htm
http://www.btsoftware.com/products/proguard.htm
There are many others out there... I have no idea how well they work, or how secure they really are..
Windows vista should allow this type of file execution restrictions. And it should do it by actually analyzing the file, not just looking at the name or extension.
Domain policies, third party software and what not are all moot if I can boot the machine with a live-cd...
Disable CD Boot from BIOS along with all the other measures mentioned?
That would kill the Live CD problem, wouldn't it? Never really used one, so I don't know. Just asking / wondering.
Cheers.
Wow Nihil, I had no idea, which James Bond film were you in??Quote:
Suppose I wander in with a CD/DVD loaded with a bootable distro of some sort.............you are OWNED And all those nice little backdoors, timebombs, keyloggers and stuff that I would load onto your system?
Jonny I'm your biggest fan and probably not very helpful today, but have just missed you all Frond
No.Quote:
Originally posted here by RejectKnowledge
Disable CD Boot from BIOS along with all the other measures mentioned?
That would kill the Live CD problem, wouldn't it? Never really used one, so I don't know. Just asking / wondering.
Cheers.
if you take the top off your pc on the motherboard there is a small silver round battery which looks a little like the type of battery's you see in watches the battery on the motherboard is called the cmos battery.
Anyway WITH THE POWER OFF THE WHOLE TIME pull the battery from whats holding it in place and leave the battery out for a minute or two then put the battery back in.
Then go into the BIOS then all the settings with be reset to their defaults even if you set a password the password will now be gone.
To try to prevent this problem you could look into "PC Entrapment Products" here are some links to some products available to give you some ideas:
http://www.secureit.co.uk/MenuSolutions/omegashow.htm
http://store.yahoo.com/wcsc/covuntowen.html
http://www.industrial-computer-enclo...protection.htm
http://www.tryten.com/products/Wc7d5969673fa7.htm
EDIT: Sorry if i jumped in head first at the start of this thread but personal problems are getting the better of me right now and i just did'nt think about the physical side of security i was just thinking about answering his question.
As stated earlier....
This IS they only way to circumventQuote:
As we are obviously talking about "the enemy within" you MUST blend in physical security and a strong AUP as part of your security model.
MLF
Sir Dice said:
That really hits the nail on the head! the actual issue is more like "How do I stop users running unauthorised executables in my environment" rather that "how do I stop them running batch files"Quote:
Domain policies, third party software and what not are all moot if I can boot the machine with a live-cd...
JonnyFrondIt isn't funny mate. Given that this sort of thing is rife in secondary schools, vocational colleges and universities, you have to assume that people you hire these days will have the knowledge and skill to pull it off....................even if they couldn't write a batch file to save their miserable lives :pQuote:
Wow Nihil, I had no idea, which James Bond film were you in??
As for the boot sequence, you can use a custom BIOS and/or an EEPROM chip, and put a lock on the case.................mess with that and you are out................instantly.............as I have said, a strong AUP is part of the model.
Also, why pay for CD/DVD drives, USB, floppy drives if you don't NEED them.
;)
Actually, with the A-brands you seem to have to pay them to leave it out these days :(Quote:
Originally posted here by nihil
Also, why pay for CD/DVD drives, USB, floppy drives if you don't NEED them.[/B]
But.. The A-brands (the corporate models at least) also have case locking so you can use those laptop type kabel/locks to lock/secure the casing and LCD to the desk. Added bonus: it'll make the computer harder to steal.. physicly that is..
BIOS boot order and password should prevent booting from anything else but the harddrive.. GPO and perhaps some third party software should give you some control over who can access thumbdrives and/or cd/dvd-roms.. The A-brands also have a small cover switch that gets activated when the case is opened.. Next time the computer boots normally it can send a signal to you.. The cloners also picked up on this so there are casings and mainboards around that also sport these 'corporate' features
I recently attended an MS Vista preview and they had 2 new features that would be handy and prevent physical access to data stored locally.
The ability to lock out usb drives...and harddrive encryption....
Not sure if these features will be available in all versions....
So far they have 3 versions for home use and 3 versions for business...
Supposedly the guts are all the same...just some features are turn on\off with the different versions.
MLF