The GAT Shield extension allows admins to track and view user behavior while logged into their Google domain account. Google Workspace Admins can set up real-time alerts based on the behavior of the end-users. With this guide, you’ll learn how to block .EXE file downloads using Shield’s alert rules.
These Alert Rules allow admins to stop and report unsafe downloads by users across their domain.
How to Report and Remove exe. File downloaded by Google Workspace Users? #
Set Up Rules to Block .EXE File Downloads #
Navigate to Shield → Configuration → Alert Rules → +Add a rule
- Add a rule for Downloads – File Download
- Alert rule name – enter a name for the rule
- Active – enable or disable the rule
-
File extension – enter the extension type, such as an exe, pdf, doc, png, mov – separate by semicolon
- File size – enter the size of the files
- Cancel/delete download – enable or disable the option to prevent the downloads of the files
- If selected (enabled), the file will be downloaded and removed from the user’s account
- If unselected (disabled), only an alert will be generated, the downloads will not be canceled
- Report file name – enable or disable the view of the file name
- Scope – enter where the rules are to be active, to which users; if blank, the rule will be applied to all Shield users
- Screen/Webcam capture – You can check the report file name, screen capture, and webcam capture to see who downloaded the file and what their screen and webcam were capturing at the time of the download.
- Site exclusion – enter the sites where the rule will not be applied to.
Select end-user action #
When the Alert rule is triggered, an action will be executed for the end-user who executed the alert.
- Display warning message
- Display warning message and close the browsing tab
- Display warning message and redirect
- Close the browsing tab without a message
- Redirect without message
- None
Result for end-user #
The end-user where the rule is applied will receive a notification on their screen, depending on what “End-user” action is selected.
The download will be removed, the user will see this message in the recent download history on their Chrome browser
Result for the Google Workspace Admin #
All the results will be displayed in Shield Alerts.
