Prevent downloading files of a certain type?

Question

Windows

The situation is as follows:
There is a CNC machine. A computer with Win XP is connected to it for viewing, editing and downloading programs to the machine. Machine operators constantly install games on this computer, bring videos, etc. Naturally, the system becomes clogged, and all working files are at risk. Requests, explanations, fines - do not help. All the same, sooner or later, a bunch of junk is found on the computer.
I cut down the rights of operators, prohibited the installation of programs, restricted access to folders. But they still bring games on a flash drive (it is impossible to prohibit external media, since designers bring these programs on flash drives and floppy disks), which do not need to be installed.
So I wanted to ask, maybe there are some ways to make a ban on downloading files of a certain format (exe, avi, etc.) into the computer? Or does anyone know a more efficient solution to this problem?
PS Now we are still considering the option of reducing the size of the working folder “back to back”, so that nothing extra could be downloaded in principle.

Answer 1

This is not a technical problem, but an administrative one. It is necessary to create conditions for the provability of transgression (the fact of uploading prohibited content) and provide for appropriate punishment. For example, attach (write/find a ready-made) download logger that tracks who and when uploaded a file. If a violation of the perpetrator is found, publicly punish the external carrier with an anally dismissal, a sensitive monetary fine.
If you act only by technical means, then the opposite side will always look for ways to circumvent the prohibitions. Moreover, there is no punishment.

Answer 2

I heard about a way to prevent the execution of executable files from a flash drive. Well, on the computer, cut down the rights as much as possible. For Ntfs folders, there is also a “Files Launch” security option, which can be removed, if you need a folder in which to dump work (http://www.sysadmins.lv/content/binary/WindowsLiveWriter/2SoftwareRestrictionPolicies_FCC0/TempACL_thumb.jpg second parameter) .

Answer 3

Programs for the machine are not exe files, are they? You can disable the launch of exe-files, leaving only the white list.

Answer 4

It is possible to prohibit the mounting of all flash drives, except for certain ones. For example, habrahabr.ru/blogs/subconsciousness/52553/

Answer 5

1. Configure Software Restriction Policy support.microsoft.com/kb/310791
2. Remove codecs and sound card driver if it is not critical for the machine
3. Create antivirus rules that define media files as viruses

Answer 6

Casper at the conference said that he has a module for working with flash drives, I think you can configure everything in it.

Answer 7

Look at gameclass.ru and analogues. I came across game class in Internet clubs as a client, the rating is satisfactory.

Answer 8

technet.microsoft.com/en-us/library/cc779607(WS.10).aspx _

Answer 9

Filesystem filter driver?

Answer 10

Standalone SecretNet 5.1 without hardware www.securitycode.ru/products/secret_net/scope/auto_edition/

Answer 11

I didn’t understand, this was still decided in the 2000s, when everyone still wore CDs.
We go into Bios and disable the CD and USB devices we need.
And Bios itself, if the "wise men" are a little literate, password-protect.
PC - seal.
Experience: Energy, Hypermarkets.