Video Screencast Help
Search Video Help Close Back
to help
New in the Rewards Catalog: Vouchers for "Symantec Technical Specialist" and "Symantec Certified Specialist" exams.

Block extract files from network share on server - device and App Control

Created: 02 Sep 2010 | 11 comments
Seralar's picture
0 0 Votes
Login to vote

Hi,

Anybody know i can do that?

Regards

Comments

Vikram Kumar-SAV to SEP's picture
02
Sep
2010
0 Votes 0
Login to vote

Get the MD5 value of the file

Get the MD5 value of the file and block it using that..
If the drive is mapped then given the complete path of the file G:\ .... Z:\...

Bekir's picture
02
Sep
2010
0 Votes 0
Login to vote

hmm. that one is a little bit

hmm. that one is a little bit tough :)

I'd suggest blocking winzip.exe and winrar.exe and windows' own zip folder executable from accessing the network drives.

Would that do ? :)

Best regards,
Bekir Burak Durmaz

Seralar's picture
03
Sep
2010
0 Votes 0
Login to vote

Vikram, This can help me to

Vikram,

This can help me to prevent copy file to my workstation?

can you give more details, I know how to generate de md5 but build the rule .hmmm

Regards

Vikram Kumar-SAV to SEP's picture
03
Sep
2010
0 Votes 0
Login to vote

Yes it will block the files

Yes it will block the files to be written to your machine..

You can try this 
In Application Control Policy.
Select the rule "Block writing to all files and folders"

Edit
Select
Block writing to removable media
Then Under "Apply this rule to follow process"
Edit and then Type the file name ( you can click on Option and give the File Finger print as well 
Then Select "Block writing to all files and folders"
then Under "Apply this to follow file and folders"
Click Edit
Then Under "Match files under following drive type"
Select "Network Drive" and Unselect rest.
Click OK
Then on the top Click on
"Actions"
Select Block Access on both the places and Select Enable Logging and Notify User.

Note :: .Apply this rule to a Test Group First...

Seralar's picture
03
Sep
2010
0 Votes 0
Login to vote
Bekir's picture
04
Sep
2010
0 Votes 0
Login to vote

Sergio, I'm not sure I've

Sergio,

I'm not sure I've understood what you want to do clearly. I thougt you wanted to block compressed file extraction from a network share on to another server. Isn't that true?
If not can you explain in detail?
:D

Best regards,
Bekir Burak Durmaz

Seralar's picture
09
Sep
2010
0 Votes 0
Login to vote

Bekir, I need to block at

Bekir,

I need to block at Workstation level files from a specific network share (docs, pdfs, xls). The final user can't write this files on their PC.

REgards 

Vikram Kumar-SAV to SEP's picture
09
Sep
2010
0 Votes 0
Login to vote
Seralar's picture
20
Sep
2010
0 Votes 0
Login to vote

Vikram, the md5 file is very big , 23 megs,

I gues that approach work for few files.

Regards

Vikram Kumar-SAV to SEP's picture
21
Sep
2010
0 Votes 0
Login to vote

have u tried with just the

have u tried with just the file name..without md5

Bekir's picture
09
Sep
2010
0 Votes 0
Login to vote

Hello Sergio, SEP cannot

Hello Sergio,

SEP cannot watch both source and destination of the file and decide according to that. All you can do is to control specific types of actions with respect to the destination drive (removable, local or network drives etc). So it will not match your need.

But if the main question is to block extraction of compressed files to local PCs from a network drive, then I would suggest blocking those common extractor processes accessing network drives only. (As I've suggested in my previous post).

Best regards,
Bekir Burak Durmaz