topic Prevent download of executables for all clients except specific users in Endpoint

Prevent download of executables for all clients except specific users

Maxh — Mon, 01 Sep 2025 14:22:18 GMT

Hello

I want to block the download of specific file types (mainly executables) for all of our clients, except for users where the download of those files is expected and permitted.

Currently I tried it with a mixed mode policy where I blocked the file types in the "Download Protection" with the "Override Default Files Actions" option for the computers, and I allowed all file types for the users. But with the user-policy I also override all the other security settings and exclusions in the computer-policy for "Web & Files Protection" and "Behavioral Protection".

Is there another (better) way to achieve that?

Also is it possible to block (or extract) ZIP-Archives that contain those filetypes?

We're running E88.62 and E89.05 with Harmony Endpoint Cloud Management with the Advanced license.

Thanks!

Re: Prevent download of executables for all clients except specific users

the_rock — Mon, 01 Sep 2025 15:30:24 GMT

I think one of our customers did this, will ask one of my colleagues tomorrow, since its long weekend today : - )

Andy

Re: Prevent download of executables for all clients except specific users

Maxh — Wed, 17 Sep 2025 09:53:37 GMT

Did you find our how your customer solved this? Thanks 🙂

Re: Prevent download of executables for all clients except specific users

slaybas — Fri, 19 Sep 2025 10:59:05 GMT

According to Check Point, it is not possible to block or extract ZIP archives that contain these file types.

"We do not have a native policy setting to directly block .exe files inside compressed archives such as ZIP, RAR, 7z.
However, if any malicious .exe gets executed, it will be triggered as standard."

Re: Prevent download of executables for all clients except specific users

the_rock — Fri, 19 Sep 2025 11:14:58 GMT

Thanks for letting us know.