{"id":208353,"date":"2023-09-27T14:43:55","date_gmt":"2023-09-27T14:43:55","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/comment-bloquer-les-executables-dans-appdata-et-dossiers\/"},"modified":"2024-03-04T20:32:08","modified_gmt":"2024-03-04T20:32:08","slug":"comment-bloquer-les-executables-dans-appdata-et-dossiers","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/comment-bloquer-les-executables-dans-appdata-et-dossiers\/","title":{"rendered":"Comment cr\u00e9er une strat\u00e9gie de restriction logicielle pour bloquer les ex\u00e9cutables dans AppData et le dossier T\u00e9l\u00e9chargements des utilisateurs ?"},"content":{"rendered":"

De nos jours, dans les environnements informatiques complexes, il est primordial de <\/span>maintenir<\/span> la s\u00e9curit\u00e9 des environnements des utilisateurs. Pour les professionnels de l’informatique et les fournisseurs de services g\u00e9r\u00e9s (MSP), l’un des d\u00e9fis consiste \u00e0 limiter l’ex\u00e9cution d’ex\u00e9cutables potentiellement dangereux qui <\/span>se trouvent<\/span> dans des emplacements tels que<\/span>AppData<\/span> ou le dossier T\u00e9l\u00e9chargements d’un utilisateur. Comprenant ce challenge, <\/span>explorons<\/span> une solution de script puissante pour bloquer les ex\u00e9cutables \u00e0 partir de <\/strong><\/span>AppData<\/span><\/strong> et d’autres emplacements d\u00e9sign\u00e9s<\/strong>.<\/span><\/span>\u00a0<\/span><\/p>\n

Comprendre les strat\u00e9gies de restriction des logiciels<\/span><\/span>\u00a0<\/span><\/h2>\n

Les strat\u00e9gies de restriction logicielle (SRP) sont une fonctionnalit\u00e9 de Windows qui permet aux administrateurs de contr\u00f4ler les logiciels qui peuvent \u00eatre ex\u00e9cut\u00e9s sur leurs ordinateurs. Les SRP peuvent \u00eatre utilis\u00e9es pour bloquer des fichiers ex\u00e9cutables sp\u00e9cifiques, des extensions de fichiers ou m\u00eame des r\u00e9pertoires entiers.<\/span>\u00a0<\/span><\/p>\n

Lorsqu’un fichier ex\u00e9cutable est ex\u00e9cut\u00e9, Windows v\u00e9rifie les param\u00e8tres SRP pour voir si le fichier est autoris\u00e9 \u00e0 s’ex\u00e9cuter. Si le fichier n’est pas autoris\u00e9 \u00e0 \u00eatre ex\u00e9cut\u00e9, un message d’erreur s’affiche.<\/span>\u00a0<\/span><\/p>\n

L’ASR est un outil puissant qui peut \u00eatre utilis\u00e9 pour prot\u00e9ger les ordinateurs contre les logiciels malveillants et autres menaces de s\u00e9curit\u00e9. Toutefois, il est important d’utiliser les SRP avec pr\u00e9caution, car il peuvent \u00e9galement emp\u00eacher l’ex\u00e9cution de logiciels l\u00e9gitimes.<\/span><\/p>\n

Le script Disable-AppDataExe.ps1<\/span><\/span>\u00a0<\/span><\/h2>\n

Le script Disable-AppDataExe.ps1 est un script PowerShell qui peut \u00eatre utilis\u00e9 pour emp\u00eacher l’ex\u00e9cution de fichiers ex\u00e9cutables dans les r\u00e9pertoires %<\/span>AppData<\/span>% et%<\/span>UserProfile<\/span>%Downloads. Le script est personnalisable, ce qui vous permet de choisir les extensions de fichiers \u00e0 bloquer et les r\u00e9pertoires \u00e0 restreindre.<\/span><\/span>\u00a0<\/span><\/p>\n

#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Creates a Software Restriction Policy to block executables from AppData and a user's Downloads folder.\r\n.DESCRIPTION\r\n    Creates a Software Restriction Policy to block executables from AppData and a user's Downloads folder.\r\n.EXAMPLE\r\n     -RestrictedDirectory \"%APPDATA%\", \"%UserProfile%Downloads\"\r\n    Creates a Software Restriction Policy to block executables from AppData and a user's Downloads folder. This is the default.\r\n.EXAMPLE\r\n    PS C:> Disable-AppDataExe.ps1 -RestrictedDirectory \"%APPDATA%\", \"%UserProfile%Downloads\"\r\n    Creates a Software Restriction Policy to block executables from AppData and a user's Downloads folder. This is the default.\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016 - DOES NOT SUPPORT WINDOWS 11\r\n    Release Notes:\r\n    Initial Release\r\n    (c) 2023 NinjaOne\r\n    By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    # Paths to block executions\r\n    [Parameter()]\r\n    [String[]]\r\n    $RestrictedDirectory = @(\"%APPDATA%\", \"%UserProfile%Downloads\"),\r\n    # Executables\r\n    [Parameter()]\r\n    [String[]]\r\n    $ExecutableTypes = @(\"ADE\", \"ADP\", \"BAS\", \"BAT\", \"CHM\", \"CMD\", \"COM\", \"CPL\", \"CRT\", \"EXE\", \"HLP\", \"HTA\", \"INF\", \"INS\", \"ISP\", \"LNK\", \"MDB\", \"MDE\", \"MSC\", \"MSI\", \"MSP\", \"MST\", \"OCX\", \"PCD\", \"PIF\", \"REG\", \"SCR\", \"SHS\", \"URL\", \"VB\", \"WSC\")\r\n)\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        if ($p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator))\r\n        { Write-Output $true }\r\n        else\r\n        { Write-Output $false }\r\n    }\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n    # Clear existing rules\r\n    $BaseRegPath = 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer'\r\n    if (Test-Path \"$BaseRegPath\") { Remove-Item \"$BaseRegPath\" -Recurse }\r\n    # Create our rule settings\r\n    New-Item \"$BaseRegPath\"\r\n    New-Item \"$($BaseRegPath)\\codeidentifiers\"\r\n    New-Item \"$($BaseRegPath)\\codeidentifiers\\0\"\r\n    New-Item \"$($BaseRegPath)\\codeidentifiers\\0\\Paths\"\r\n    New-ItemProperty \"$($BaseRegPath)\\codeidentifiers\" -Name 'authenticodeenabled' -Value 0 -PropertyType DWord\r\n    New-ItemProperty \"$($BaseRegPath)\\codeidentifiers\" -Name 'DefaultLevel' -Value 262144 -PropertyType DWord\r\n    New-ItemProperty \"$($BaseRegPath)\\codeidentifiers\" -Name 'TransparentEnabled' -Value 1 -PropertyType DWord\r\n    New-ItemProperty \"$($BaseRegPath)\\codeidentifiers\" -Name 'PolicyScope' -Value 0 -PropertyType DWord\r\n    New-ItemProperty \"$($BaseRegPath)\\codeidentifiers\" -Name 'ExecutableTypes' -Value $ExecutableTypes -PropertyType MultiString\r\n\r\n    foreach ($Directory in $RestrictedDirectory) {\r\n        $pathguid = [guid]::newguid()\r\n        $newpathkey = \"$($BaseRegPath)\\codeidentifiers\\0\\Paths{\" + $pathguid + \"}\"\r\n        if ((Test-Path -LiteralPath $newpathkey) -ne $true) { New-Item $newpathkey }\r\n        New-ItemProperty -LiteralPath $newpathkey -Name 'SaferFlags' -Value 0 -PropertyType DWord\r\n        New-ItemProperty -LiteralPath $newpathkey -Name 'ItemData' -Value $Directory -PropertyType ExpandString\r\n    }\r\n    gpupdate.exe \/force\r\n}<\/pre>\n
 <\/p>\n\n\n
Comment utiliser le script<\/span><\/span>\u00a0<\/span><\/h2>\n
Pour utiliser le script Disable-AppDataExe.ps1, vous devez avoir install\u00e9 PowerShell et l’ex\u00e9cuter avec des privil\u00e8ges administratifs. Une fois que vous avez le script, vous pouvez l’ex\u00e9cuter en tapant la commande suivante \u00e0 l’invite de PowerShell :<\/span>\u00a0<\/span><\/p>\n
.NDisable-AppDataExe.ps1<\/span><\/p>\n
Le script emp\u00eachera alors les fichiers ex\u00e9cutables sp\u00e9cifi\u00e9s de s’ex\u00e9cuter dans les r\u00e9pertoires indiqu\u00e9s.<\/span>\u00a0<\/span><\/p>\n
Conclusions<\/h2>\n
Le script Disable-AppDataExe.ps1 est un outil utile pour bloquer l’ex\u00e9cution de fichiers ex\u00e9cutables dans des r\u00e9pertoires sp\u00e9cifiques. Cependant, il est important d’\u00eatre conscient de ses limites. En comprenant comment fonctionne les SRP et comment utiliser le script, vous pouvez contribuer \u00e0 prot\u00e9ger vos ordinateurs contre les logiciels malveillants et les autres menaces de s\u00e9curit\u00e9.<\/span>\u00a0<\/span><\/p>\n
Voici quelques \u00e9l\u00e9ments suppl\u00e9mentaires \u00e0 prendre en compte lors de l’utilisation du script Disable-AppDataExe.ps1 :<\/span>\u00a0<\/span><\/p>\n