Ban web and other directories to execute exe, bat, com methods

Still being hacked for the site. Worried about being able to run executable files by people?

For a web directory. There is no need to run the executable file at all. Here is a way to teach everyone.

Use gpedit.msc (group policy) to prevent directories from executing certain files.

First:

Run-----Enter gpedit.msc ----Computer Configuration---Windows Settings----Security Settings ↓

- --- Software restriction policy (if there is nothing next to it. Right click to create a policy) --- Other rules --- (right click) to create a new path rule (p).

Figure 1:

In this way d: \\ wwwroot \\ directory can not execute any exe.bat.com files. No matter what permissions you have. Even the system can't execute.

This greatly improves the security of using the exp to increase permissions.

Of course, here is an idea. . Everyone knows that c:\\windows\\temp\\ is a temporary folder. Basically all users can write. It does not require execution rights.

Of course we can add a rule to him here. Let c:\\windows\\temp\\ have no execute permission. The method is as above.