Prevent the execution of programs on unauthorized paths

[rqueizan]

Is it possible to block the execution of any executable (exe, bat, ps1) of disk D from Kaspersky Premium 21.15.8.493(a)?

Windows 11 Enterprise 22H2, Build 22621.3085

My goal is to allow the execution of everything that is on disk C, and some folders on disk D, the rest that is restricted.

[Guilhermesene4096]

@rqueizanWelcome back

Please see

Maybe this will give you an idea and help you 🙂

 

Edited January 28 by Guilhermesene4096

[rqueizan]

This way it works, more aggressive than I'd like, but it solves in the worst-case scenario.
It would be interesting if in addition to Read, Write, Create and Delete it allowed Run independently. Suggestion.

The way shown in the image, it allows me to take it out of that folder, and put it back in.
Prevents the icon from being displayed.
But it definitely blocks execution.

Edited January 28 by rqueizan

[Guilhermesene4096]

@rqueizan

Thanks for the feedback, and I'm glad you got it 👍

Thanks for the suggestions, but "Read" basically means "Run/Open".

In your scenario, basically we have that on disk D no file with the ".exe" extension has read permission, that is, they do not have permissions to be read from disk D, therefore, they cannot be executed/opened.

Edited January 28 by Guilhermesene4096

[harlan4096]

Read also may mean just "Access" to the file/folder or in general to the resource...

[Guilhermesene4096]

1 minute ago, harlan4096 disse:

Read also may mean just "Access" to the file/folder or in general to the resource...

Exactly, that's what I meant 👍

[rqueizan]

1 hour ago, harlan4096 said:

Read also may mean just "Access" to the file/folder or in general to the resource...

Initially, I thought Read refers to the action of reading.
That's why I find it a bit confusing to block an execution by blocking the Read option.
In addition, it allows me to cut the file from the folder, and paste it back in.
To cut a file, you need Read and Write.

[rqueizan]

There is a problem with this form of blocking.
It will notify you every time a program accesses to list files, not necessarily by running it.
The rule applies when the restricted folder is listed by a file explorer such as Total Commander or Windows Explorer itself.

I think it would be best to add a new column, explicitly involving the execution of a program.
 

Edited January 28 by rqueizan

[Guilhermesene4096]

@rqueizan

It is obvious that the rule defined by you is wrong.

You have applied "deny" to all groups (Trusted, Untrusted, High restriction and Low restriction)

You can even do this for disk D, but you need to release fundamental applications like Microsoft so that Windows applications like explorer.exe can read all files on the disk.

Spoiler

This configuration is my personal configuration in a specific scenario and in a specific situation

This is why Kaspersky defines this module only for advanced users.

This is a complex component of Kaspersky and with it there are countless possibilities for using this component.

My personal advice to you is: study the tutorial I gave you in more depth. (see that it's not that I don't want to help or assist you, it's that it's a component with countless possibilities and that requires a certain degree of knowledge of its operation)

Edited January 28 by Guilhermesene4096

[rqueizan]

More detailed scenario:
I don't want anyone to have permission to run any EXE files from the D:\Download folder and its subfolders.
Otherwise, they can copy, cut, create, delete freely.

This is my real goal!

In the absence of an execute permission, I denied all read permission on the folder, regardless of the level of trust.
This certainly blocks execution, and doesn't interfere with copying files.
It only bothers me that the rule actually applies every time someone accesses the file list of the folder in question.

My ultimate goal is to restrict the execution of any executable (exe, msi, bat, ps1, com) on the entire D disk.
And only allow it to run on a certain folder on disk D.

But I consider that the launch of the event by simply listing the files in a folder is so bulky, I think that by putting the whole disk, it could be chaos, perhaps a high consumption of CPU and RAM resources. An anticipatory speculation on my part.

[rqueizan]

On the other hand, when cutting a file from disk C to disk D. Technically you have to do a read on disk C, write to disk D, delete the original file on disk C.
If I blocked the read permission, I theoretically shouldn't be able to copy or cut it, since I'm not allowed to read it, right?

If an execute permission exists, the execution goes beyond a read, as it needs to be loaded into memory to execute. This would initially involve a disk read and a RAM write.
It could block execution without restricting the read, allowing the file to be copied and cut.