Wow, its been some time i wrote something since i took on my new role. Thought i should pick up my “pen”, erm, rather keyboard and start striking again.
The main focal point of today’s entry in my tech diary, is spurned by a question, can i block ftp.exe program from running in Windows 7. As we all know, Windows 7 loads up with ftp.exe as a process installed. Try opening your command prompt and type “ftp”.
At this time, you open up the task manager, you’ll notice “ftp.exe” amongst the many processes you have.
FTP on its own isn’t a very secure protocol. Its been around for a very long time. Secure FTP is the preferred way of doing FTP these days. A good Admin will secure all sensitive protocol with IPSec, but that is out of scope at the moment for this short write up.
To prevent “FTP.EXE” from being loaded, there are several ways. One of the most primitive way is to delete the file. Yup, an easy but not enforceable, because someone can simply copy and put it back.
To completely prevent FTP.EXE from running, one should be exploring using enforcement via Group Policies. It is the most effective way of governance across the enterprise.
Here are the steps (Done locally on a Windows 7 client, you should do this via GPMC on the right domain policy):
- Edit the appropriate GPO and navigate to “Computer Configuration-> Windows Settings –> Security Settings –> Software Restriction Policies.
- Create a new Software Restriction Policy if it isn’t already created.
- in the Software Restriction Policy, click on Additional Rules.
- Right click Additional Rules and click on New Hash Rule
- To identify the binary running ftp.exe, click on Browse and locate “C:\Windows\System32\ftp.exe”.
- Under security level, select disallowed and click OK.
At this stage, your computer has been updated with the new GPO. However, it will not take effect till the next reboot or till you run the command “gpupdate /force”.
After which, try running FTP. You should be greeted with this message
You can use this technique to prevent banned software from running. On the flip side, you couldn’t also block all software from running except for selected few. Have fun.