In Classics Rock, I highlighted a tip from 1999 about how to keep NetWare users from messaging each other. Plus, I discussed how to disable Net Send in a Windows environment.
http://blogs.techrepublic.com.com/classic-tech/?p=209
Windows Vista however includes MSG.EXE which does the same thing, but not via the Messenger service like Net Send. Short of erasing MSG.EXE can anyone think to how to disable it or block message transmissions?
Discussion on:
View:
Show:
Before I learned of a more elegant way to block the evil ctfmon.exe, I used group policy's "Software Restriction Policies" feature to disable it throughout the LAN.
Navigate to:
Computer Configuration/Windows Settings/Software Restriction Policies/Additional Rules
Right-click in the right-hand pane and choose "New Hash Rule." Browse to and select msg.exe. The "File hash" and "File information" fields will be filled out for you, leaving you to fill in the optional "Description." Leave the "Security level" drop-down at the default "Disallowed."
Now anytime that a user or process attempts to run msg.exe, it will fail, and an entry will be written to the Application log in Event Viewer. This works great on all of those annoying startup processes that msconfig just can't seem to beat! =)
One caveat is that if the software that is on your server is of a different version than that on your workstations (as occurred to me with ctfmon.exe), the hash will be different and the workstations will continue to happily run the offending code. A little rename, copy & paste before creating the new hash rule will get you around that, as would creating the hash rules locally on the workstations.
HTH,
JimmyJazz
Navigate to:
Computer Configuration/Windows Settings/Software Restriction Policies/Additional Rules
Right-click in the right-hand pane and choose "New Hash Rule." Browse to and select msg.exe. The "File hash" and "File information" fields will be filled out for you, leaving you to fill in the optional "Description." Leave the "Security level" drop-down at the default "Disallowed."
Now anytime that a user or process attempts to run msg.exe, it will fail, and an entry will be written to the Application log in Event Viewer. This works great on all of those annoying startup processes that msconfig just can't seem to beat! =)
One caveat is that if the software that is on your server is of a different version than that on your workstations (as occurred to me with ctfmon.exe), the hash will be different and the workstations will continue to happily run the offending code. A little rename, copy & paste before creating the new hash rule will get you around that, as would creating the hash rules locally on the workstations.
HTH,
JimmyJazz
- Keyboard Shortcuts:
- Prev
- Next
- Toggle
