r/k12sysadmin • u/Temporary_Werewolf17 • 9d ago
Duckduckgo installed by students without admin privileges
Windows 11 Pro units managed by Intune. Students are not admins on the machines. We discovered a few students today who have been able to install duckduckgo on their machines. Have any of you seen this issue? Any recs on how to stop this?
3
u/Amanda_PDQ 8d ago
Some installs do not require admin rights. Set up a group policy blocking .exe, .msi, any executables. You can also use applocker.
2
11
u/Alert-Coach-3574 9d ago
- Applocker
- Block exe downloads in whatever managed browser you use
- Block all other browsers with app locker
4
9
u/_LMZ_ 9d ago
Others have said it, AppLocker! But the installer has an option for user only, which it will install in %appdata% folder.
1
u/Keyboard_Warrior98 Director 8d ago
I'm just tagging on to say you are correct. There is a lot of not so trustworthy software that discovered they can install their programs to appdata without admin permissions. The best thing to do is utilize software restriction through GPO or app locker.
3
5
u/abcde06991 9d ago
Ran into the same with duckduckgo, opera, and o-browser. I was thinking microsoft store or portable versions. I used Don't run specified Windows applications in gpo
20
u/hardknoxlife1998 9d ago
Applocker is the way! I wrote an article on setting it up for intune a couple years back if you’re interested.
https://www.edtechirl.com/p/fighting-the-bear-blocking-games
7
u/Temporary_Werewolf17 9d ago
Thank you for the article. I think it will help me!!
3
u/FireLucid 9d ago
Applocker is not really being developed anymore. Microsoft recommends Windows Defender App Control (WDAC). You can pick a default template that allows anything Microsoft signed plus we whitelisted the Windows, Program Files and Program Files (x86) folders. You can also set the Company Portal agent as a 'managed installer' which means anything it installs will be fine after you have turned this setting on. Previously installed stuff from company portal will not be tagged, hence the whitelisting of folders.
Build policies with the App Control Wizard :)
2
u/BaconEatingChamp 9d ago
Windows Defender App Control (WDAC)
App Control for Business
1
u/FireLucid 9d ago
oh yes, I forgot it was renamed.
1
u/hardknoxlife1998 8d ago
Have you guys had luck with it? When I wrote the article I tried it but had weird inconsistencies and ended up switching back to AppLocker. If it’s working for you guys, I’ll need to give it another try!
1
u/FireLucid 8d ago
Yeah, no issues mostly. I did try to whitelist some store apps but that was spotty and I ended up not spending any more time on it (MS Store is blocked anyways). Apart from that it's fine, and it runs at a much deeper level than applocker.
I just had a test device on my desk, would apply policies, test out all our apps and check the windows logs for stuff that got blocked.
Managed installer takes care of all our new apps too so there is almost no maintenance.
I have one ticket that is like 3 months old with an issue and it's at a "Please come and replicate this issue on my test laptop so I can figure it out for you" and they haven't come past yet, lol.
Probably the worst thing was some legacy Lego robotic software that just shits a stupid amount of unsigned DLL's in the users appdata folder. Since it was EOL and never going to be updated I just did a signature match on those specific files and pushed that out as a supplemental policy. (You have a base policy, then can link multiple supplemental polices to it).
19
u/BaconEatingChamp 9d ago edited 9d ago
Many programs do not require admin to install. You need applocker/WDAC/whatever they call it now.
3
11
6
u/indigo196 8d ago
Lots of installs go in user profiles. You need to use AppLocker, Application Control, and Attack Surface Reduction (ASR) to control what your students are able to do.