Using Ranger to prevent Internet downloads

Question

Can Ranger disable internet downloads for particular users?

Cause

In some situations you may need to ban just a few users from within a group whereby using the solutions in the article above would be too restrictive.

Resolution

Ranger React allows you to block Internet downloads by manipulating the users registry. This restriction can be implemented against particular users, all users when they logon into a particular location or be time specific.

Ranger React can be used to watch for a network event i.e. a user logging onto a workstation within a particular location and a given time range. When these conditions are met the rule is triggered performing a particular task for example running a program on the computer that triggered the rule.

A rule of this kind would allow you to execute a utility we designed to dynamically and silently merge a registry file into the users profile disable Internet downloads.

There are two parts to this solution. The first part is to ensure the Internet settings are reset, configured to allow users to download files. The second part is to configure a Ranger React rule that will turn off Internet downloads based on the conditions you define.

Instructions

Enable Internet Downloads

To check that Internet downloads are enabled by default open Ranger Administrator and then go to OS > Environment > Groups > Policies > IEsettings.adm > Security. Make sure the policy 'Disable file downloads in Internet Explorer' is unchecked (white).

If the IESettings.adm is not listed under 'Groups > Polices' then check the ADM file has been added to the correct Environment. Go to Edit > Settings > Environment and click on the appropriate OS tab.

If the ADM file is not list then add the ADM file.

Configure the rule to disable Internet Downloads

Note: In step 4 you need to provide the name of a 'Custom Merge File'.

Step 1

In LAN Ranger go to the Ranger React tab and create a new rule, give the new task a meaningful name.

Step 2

Set the task to run when a user logs on and then click add to specify the trigger details.

Define which users the rule will affect. In this example we want to affect all users who logon in a selected location.

Click next to continue after you have specified the trigger details.

Step 3

Select 'action performed on the client'.

Step 4

Configure the rule to start the following command "servername\ranger\rgrregup.exe servername\ranger\filename.txt"

Make the appropriate modifications to the file name and path.

Step 5

Click add to specify which clients the task should be run on, this should be the 'machine the event was triggered on'.

Step 6

Click finish to complete the wizard and add the rule.

You should have now created a new rule. Make sure the rule is ticked in order for the rule to be enabled.

Testing

Logon to a machine within the monitored location and try to download a file from the Internet. If the registry file has been successfully applied the download will be blocked and a error message will appear.

Next check that when you logon to a machine outside the denied location that Internet downloads are enabled.