Prevent program installations from running

Mike,

MikeMecanic said:

Why Tor browser(s) bothers you that much?

For the reason stated in the OP's very first paragraph.

MikeMecanic said:

Those who download it are smarter than average

Common civility prevents me from posting the single word retort that such an outlandish claim deserves.

All the best,
Denis

MikeGreo said:

Now if I rename "tor.exe" it won't launch. Does that mean I can use that registry prevention method and it will prevent the Tor Browser from ever launching even with file renames? Referring to this one:



Does the above already target "Tor Browser\Browser\TorBrowser\Tor\tor.exe" and if not how do I rewrite the registry hack mentioned above to target it?

No need. Any process named tor.exe regardless of location will launch trhe script via debugger

MikeGreo said:

But this is not a very realistic approach. I have to scour the internet for every website that it might be possible to download Tor Browser. Which I had done, but it's possible to always miss some, and new websites popup over time.

When I want to download TOR I have to do it via TOR, because virtually all downloads are linked to the original webpage. I have it blocked via NextDNS blocking VPNs. But he can get installer via USB or he can send it to himself via an email, so that is not the way to do it.



TOR connects via other TCP ports, so you can block all TCP Out 1025-65535.
Technically if you block all but allowed apps, that would do as well.
You can try this trick, is is easy to bypass, but it is worth a shot.

Code:

reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "DisallowRun" /t REG_DWORD /d "1" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "1" /t REG_SZ /d "firefox.exe" /f
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v "2" /t REG_SZ /d "tor.exe" /f

Dear Mike, another layer if you will at a higher level,
To learn more about the Tor project, read the file properties signature. Such users are not dummies on four legs and for now they challenge you. Be aware that together they have the aptitudes and abilities to be troublemakers.
Take good note also, that by blocking the USB ports, the executable file and its related target, rigidity leads to unexpected results.
Here's what the tarball package (alpha) returns when defaulted:

Code:

Google Chrome cannot determine or set the default browser

Without Tor, in some areas of the world humanity is in danger.

RE: Reg file. Note that Tor should not function (be unable to connect) even if the browser launches. In any case if the regular firefox browser is not required to be installed then you can modify the reg file to block firefox.exe. Tor uses aversion of firefox ESRi.

MikeGreo said:

Just found out that the program Onion Connect(which seems to also use Tor Browser) also bypasses the protections.

That's not correct. It uses TOR Network and default browser (or any installed browser). I use it myself sometimes.


Firefox:

Edge Chromium:

As already suggested try group policy + applocker. That's not something I know much about.