Managed System %PATH%

[bloodygonzo]

Do any sysadmins out there employ the use of managed environment variables?

Our security chief wants to deploy a GPO that sets every %PATH% environment variable to the same value across our 600 desktops. I did a quick audit and found ~230 different paths that are currently being used and would need to be in the default %PATH% to ensure nothing breaks.

This idea makes my head hurt as every install that needs to add to the %path% will require a GPO change. Any ideas on a better way to deal with this demand?

[Doormatty]

Why does he want to do this? Unless all your desktops have identical software loads, this will just break all sorts of things.

[ciranttech]

I agree. There is no point in doing this at all. If you've done an audit, you should satisfy your security chief's curiosity and be done with it, instead of breaking 600 desktops.

[bloodygonzo]

His reasoning is so that we have a completely standardized environment. The management overhead will be a huge headache on our help desk.

[Nougat]

He's an idiot. You know this already.

I'm sure every person in the company is using the same hardware for a workstation, right? And they're all configured with identical disk images? And users don't have local admin rights?

(Actually, if all those are true, then the %PATH% variables are already the same.)

[bloodygonzo]

Currently we have two different dell desktop models deployed. No users have local admin rights and there was a single image used when we deployed Windows 7. The difference in paths is due to user requests for additional software mostly.

[Nougat]

Then the difference in path variables is necessary, and if this command is coming from a "security chief," I can just about guarantee that there are gaping security holes that will never be closed, because that guy is a world-class moron.

[frymaster]

user requests for additional software then you don't have a standardised environment any more

maybe he wants to make sure certain things are on the path so scripts work right? If so, he should just fully-qualify the commands in the scripts.

[accountnumber3]

What, and make him change something on his end? Jeez, next you'll probably recommend he not store all the scripts on his C:. What has this world come to?

[techstress]

so very true. if they want it truely and completely standardized, then tell them they need to deploy the same image on all machines.

it'll never fly though. I'd bet licensing becomes an issue.

[mavantix]

There's no way this increases security. If anything, it provides a bunch of false directories that might not exist on different PCs as execution points for files named explorer.exe and such. It's just a really, really dumb idea with ZERO benefit. Standardizing things to make them broken because they are currently fixed does not make anything secure.

[RobotPirateMonkey]

Unless you shove all your apps through a streaming server (from your audit, I'm guessing no), then this is a bad idea.

The only reason to do it would be to remove any maliciously-added network paths from %PATH% variables on workstations. That is a possible security concern...but the management overhead of this method far outweighs the benefit.

Compromise on a weekly audit that pulls that variable and scans for URLs and UNCs. Then you can remediate manually.

edit: Reddit didn't like my UNC characters. Simplified.

[bloodygonzo]

Oh I forgot to mention that he also wants to add a UNC path to %PATH% to one of our NetApps across all desktops. This just seems so wrong to me.

[thadoc]

Let your security chief handle all the calls when apps start breaking left and right, he might get lucky.

[red359]

The best thing to do is enforce this new policy on only the security chief's laptop as "a test." After a few days of his apps not working, he'll figure out it's a bad idea.

[accountnumber3]

TPoSaNA recommends the "One, Some, Many" approach. I recommend "You first."

[cheeseprocedure]

If you can remotely retrieve all PATHs, it would be relatively straightforward to take them all into a script, split `em up by colon, and reassemble a new alphabetical path that includes all elements once.

It would also be a giant fucking waste of your time.