I’m working for a large organization which is using some Windows products that require python to work.
Python is used to execute built in utility scripts and the user never recognizes that python is involved, Since the security requirements of the system are quite strict we are trying to lock down python as much as possible. We normally don’t allow normal users to use compilers or interpreters since it’s not allowed to add applications or functionality to the system. So we are looking for tips about how to restrict python so that only some scripts are allowed to run while the interactive prompt/interpreter is not available.
Is that even possible?
Our first approach was looking into restricting python with group policies, but that is not easily done since Python is not “GPO aware”. Using software restriction policies are basically a block Python for all or allow Python for all.
Since python scripts are run through the interpreter (python.exe), the GPO software restriction settings for executable locations only checks the python.exe and not the script location itself (the GPO system only sees the python script as a generic argument to the python.exe executable).
So my question is: if anyone has have any experience in tightening the security concerning python? One again, our goal is that only some scripts are allowed to run while the interactive prompt/interpreter is not available, Is that even possible?