I'm trying to set up strict browser restrictions on a Windows system and need some expert tips on preventing users from accessing the internet through anything other than a specific version of Google Chrome. Here's what I'm aiming for:
- Completely block all other web browsers, like Edge, Brave, and Opera.
- Prevent the use of portable browsers and renamed executables.
- Stop any embedded browsing from apps like Discord or Chromium-based programs.
- Game clients like Steam must work normally but without allowing free browsing in their web interfaces.
It's crucial that no other browser can open, even briefly. I currently have a process monitoring loop that checks every 0.3 seconds to block unauthorized executable names, digital signatures, and loaded DLLs. I also have a whitelist for Chrome and special handling to allow Valve-signed Steam processes without giving users browsing access.
What I'm hoping to achieve are better detection strategies and advice on more robust enforcement techniques, possibly at the kernel level or with AppLocker. Any insights into this would be greatly appreciated!
4 Answers
You might want to consider blocking traffic at the firewall level. While your goal is to control application access rather than just block network traffic, it's worth exploring ways to restrict apps from ever opening a browsing context, which could help achieve your restrictions more effectively.
AppLocker is specifically designed for managing application execution in a Windows environment. It would be ideal for setting up these strict restrictions you're looking for since it can prevent unauthorized applications from running.
Active Directory Group Policy could be your best bet here. However, if your organization has no contractual or legal obligation, the costs of administration might outweigh the benefits. Configure a next-gen firewall alongside that for added protection.
Just a thought, but you might be dealing with a classic XY problem here. It seems tailored for a very specific use case that might not be typical. Have you considered what underlying issues are prompting such deep restrictions?
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures