Prevent download of executables for all clients except specific users

[Maxh]

Hello

I want to block the download of specific file types (mainly executables) for all of our clients, except for users where the download of those files is expected and permitted.

Currently I tried it with a mixed mode policy where I blocked the file types in the "Download Protection" with the "Override Default Files Actions" option for the computers, and I allowed all file types for the users. But with the user-policy I also override all the other security settings and exclusions in the computer-policy for "Web & Files Protection" and "Behavioral Protection".

Is there another (better) way to achieve that? 

Also is it possible to block (or extract) ZIP-Archives that contain those filetypes? 

We're running E88.62 and E89.05 with Harmony Endpoint Cloud Management with the Advanced license.

Thanks!

[the_rock]

I think one of our customers did this, will ask one of my colleagues tomorrow, since its long weekend today : - )

Andy

[Maxh]

Did you find our how your customer solved this? Thanks 🙂

[slaybas · Accepted solution]

According to Check Point, it is not possible to block or extract ZIP archives that contain these file types.

"We do not have a native policy setting to directly block .exe files inside compressed archives such as ZIP, RAR, 7z.
 However, if any malicious .exe gets executed, it will be triggered as standard."

[the_rock]

Thanks for letting us know.