{"id":808021,"date":"2026-05-13T10:59:30","date_gmt":"2026-05-13T10:59:30","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&p=808021"},"modified":"2026-05-13T10:59:30","modified_gmt":"2026-05-13T10:59:30","slug":"como-bloquear-executaveis-de-dados-e-pastas-de-aplicativos","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/pt-br\/script-hub\/como-bloquear-executaveis-de-dados-e-pastas-de-aplicativos\/","title":{"rendered":"Como criar uma pol\u00edtica de restri\u00e7\u00e3o de software para bloquear execut\u00e1veis da AppData e da pasta de downloads dos usu\u00e1rios"},"content":{"rendered":"

Nos complexos ambientes de TI atuais, \u00e9 fundamental manter a seguran\u00e7a dos ambientes dos usu\u00e1rios. Para os profissionais de TI e os provedores de servi\u00e7os gerenciados (MSPs), um desafio \u00e9 restringir a execu\u00e7\u00e3o de execut\u00e1veis potencialmente prejudiciais que residem em locais como AppData ou na pasta Downloads de um usu\u00e1rio. Compreendendo esse desafio, vamos nos aprofundar em uma solu\u00e7\u00e3o de script avan\u00e7ada para bloquear execut\u00e1veis do AppData e de outros locais designados<\/strong>.<\/p>\n

Compreens\u00e3o das pol\u00edticas de restri\u00e7\u00e3o de software<\/h2>\n

As pol\u00edticas de restri\u00e7\u00e3o de software (SRP) s\u00e3o um recurso do Windows que permite aos administradores controlar quais softwares podem ser executados em seus computadores. A SRP pode ser usada para bloquear arquivos execut\u00e1veis espec\u00edficos, extens\u00f5es de arquivos ou at\u00e9 mesmo diret\u00f3rios inteiros.<\/p>\n

Quando um arquivo execut\u00e1vel<\/a> \u00e9 executado, o Windows verifica as configura\u00e7\u00f5es de SRP para ver se o arquivo tem permiss\u00e3o para ser executado. Se o arquivo n\u00e3o tiver permiss\u00e3o para ser executado, ser\u00e1 exibida uma mensagem de erro.<\/p>\n

O SRP \u00e9 uma ferramenta avan\u00e7ada que pode ser usada para ajudar a proteger os computadores contra malware e outras amea\u00e7as \u00e0 seguran\u00e7a. No entanto, \u00e9 importante usar o SRP com cuidado, pois ele tamb\u00e9m pode bloquear a execu\u00e7\u00e3o de softwares leg\u00edtimos.<\/p>\n

O script Disable-AppDataExe.ps1<\/h2>\n

O script Disable-AppDataExe.ps1 \u00e9 um script do PowerShell que pode ser usado para impedir a execu\u00e7\u00e3o de arquivos execut\u00e1veis nos diret\u00f3rios %AppData% e %UserProfile%Downloads. O script \u00e9 personaliz\u00e1vel, de modo que voc\u00ea pode escolher quais extens\u00f5es de arquivo bloquear e quais diret\u00f3rios restringir.<\/p>\n

#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Creates a Software Restriction Policy to block executables from AppData and a user's Downloads folder.\r\n.DESCRIPTION\r\n    Creates a Software Restriction Policy to block executables from AppData and a user's Downloads folder.\r\n.EXAMPLE\r\n     -RestrictedDirectory \"%APPDATA%\", \"%UserProfile%Downloads\"\r\n    Creates a Software Restriction Policy to block executables from AppData and a user's Downloads folder. This is the default.\r\n.EXAMPLE\r\n    PS C:> Disable-AppDataExe.ps1 -RestrictedDirectory \"%APPDATA%\", \"%UserProfile%Downloads\"\r\n    Creates a Software Restriction Policy to block executables from AppData and a user's Downloads folder. This is the default.\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016 - DOES NOT SUPPORT WINDOWS 11\r\n    Release Notes:\r\n    Initial Release\r\n    (c) 2023 NinjaOne\r\n    By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    # Paths to block executions\r\n    [Parameter()]\r\n    [String[]]\r\n    $RestrictedDirectory = @(\"%APPDATA%\", \"%UserProfile%Downloads\"),\r\n    # Executables\r\n    [Parameter()]\r\n    [String[]]\r\n    $ExecutableTypes = @(\"ADE\", \"ADP\", \"BAS\", \"BAT\", \"CHM\", \"CMD\", \"COM\", \"CPL\", \"CRT\", \"EXE\", \"HLP\", \"HTA\", \"INF\", \"INS\", \"ISP\", \"LNK\", \"MDB\", \"MDE\", \"MSC\", \"MSI\", \"MSP\", \"MST\", \"OCX\", \"PCD\", \"PIF\", \"REG\", \"SCR\", \"SHS\", \"URL\", \"VB\", \"WSC\")\r\n)\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        if ($p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator))\r\n        { Write-Output $true }\r\n        else\r\n        { Write-Output $false }\r\n    }\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n    # Clear existing rules\r\n    $BaseRegPath = 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\safer'\r\n    if (Test-Path \"$BaseRegPath\") { Remove-Item \"$BaseRegPath\" -Recurse }\r\n    # Create our rule settings\r\n    New-Item \"$BaseRegPath\"\r\n    New-Item \"$($BaseRegPath)\\codeidentifiers\"\r\n    New-Item \"$($BaseRegPath)\\codeidentifiers\\0\"\r\n    New-Item \"$($BaseRegPath)\\codeidentifiers\\0\\Paths\"\r\n    New-ItemProperty \"$($BaseRegPath)\\codeidentifiers\" -Name 'authenticodeenabled' -Value 0 -PropertyType DWord\r\n    New-ItemProperty \"$($BaseRegPath)\\codeidentifiers\" -Name 'DefaultLevel' -Value 262144 -PropertyType DWord\r\n    New-ItemProperty \"$($BaseRegPath)\\codeidentifiers\" -Name 'TransparentEnabled' -Value 1 -PropertyType DWord\r\n    New-ItemProperty \"$($BaseRegPath)\\codeidentifiers\" -Name 'PolicyScope' -Value 0 -PropertyType DWord\r\n    New-ItemProperty \"$($BaseRegPath)\\codeidentifiers\" -Name 'ExecutableTypes' -Value $ExecutableTypes -PropertyType MultiString\r\n\r\n    foreach ($Directory in $RestrictedDirectory) {\r\n        $pathguid = [guid]::newguid()\r\n        $newpathkey = \"$($BaseRegPath)\\codeidentifiers\\0\\Paths{\" + $pathguid + \"}\"\r\n        if ((Test-Path -LiteralPath $newpathkey) -ne $true) { New-Item $newpathkey }\r\n        New-ItemProperty -LiteralPath $newpathkey -Name 'SaferFlags' -Value 0 -PropertyType DWord\r\n        New-ItemProperty -LiteralPath $newpathkey -Name 'ItemData' -Value $Directory -PropertyType ExpandString\r\n    }\r\n    gpupdate.exe \/force\r\n}<\/pre>\n
 <\/p>\n\n\n
Como usar o script<\/h2>\n
Para usar o script Disable-AppDataExe.ps1, voc\u00ea precisar\u00e1 ter o PowerShell instalado e execut\u00e1-lo com privil\u00e9gios administrativos. Quando tiver o script, voc\u00ea poder\u00e1 execut\u00e1-lo digitando o seguinte comando no prompt do PowerShell:<\/p>\n
.Disable-AppDataExe.ps1<\/p>\n
O script bloquear\u00e1 a execu\u00e7\u00e3o dos arquivos execut\u00e1veis especificados nos diret\u00f3rios especificados.<\/p>\n
Considera\u00e7\u00f5es finais<\/h2>\n
O script Disable-AppDataExe.ps1 \u00e9 uma ferramenta \u00fatil para bloquear a execu\u00e7\u00e3o de arquivos execut\u00e1veis em diret\u00f3rios espec\u00edficos. No entanto, \u00e9 importante estar ciente de suas limita\u00e7\u00f5es. Ao entender como o SRP funciona e como usar o script, voc\u00ea pode ajudar a proteger seus computadores contra malware e outras amea\u00e7as \u00e0 seguran\u00e7a.<\/p>\n
Aqui est\u00e3o alguns aspectos adicionais que voc\u00ea deve ter em mente ao usar o script Disable-AppDataExe.ps1:<\/p>\n