The invoice was a .exe. The "PDF" had a second extension hiding behind the first. Almost every office malware story starts the same way — something was downloaded in a browser and opened. This guide puts a policy on that exact moment.
Antivirus vendors will tell you the same thing in private: the most common way malware enters a small office is not a hacker breaking in — it is a staff member downloading a file in a browser and opening it. The fake courier invoice, the "updated" tax form, the free software crack. Browsers try to help with warnings, but a warning that appears ten times a day gets clicked away like a cookie banner. Download control in Browser Security Plus moves the decision from the busy user to a policy set once by IT: which file types may be downloaded at all, from which kinds of sites, and what happens to the risky ones. Used well, staff never notice it — until the day it quietly stops the file that would have emptied the accounts folder.
Not all downloads are equal. The dangerous shortlist is small: executables (.exe, .msi, .scr), scripts (.js, .vbs, .bat, .ps1), macro documents from outside senders, and archives (.zip, .iso, .img) used to smuggle the first three past scanners. A normal accounts clerk needs exactly none of these from the open internet. Your software installs should arrive through IT's managed channel, not through a browser. That one sentence is the whole policy; everything below is just enforcing it by role.
In the console, build download policies per group the same way you built the core policies. General staff: block executables and scripts from the web entirely. IT and developers: allow them, because blocking a sysadmin's tools only teaches them to use a personal laptop. Front desk and shared PCs: the strictest set, plus blocked archives. Test each policy on the pilot group first — a policy that blocks the bank's statement download format on the 1st of the month will be removed by the 2nd, and a removed policy protects nothing.
Chrome's Safe Browsing and Edge's SmartScreen check downloads against lists of known-bad files and sites — but only while they are switched on, in their stronger mode, and users can switch them off after one annoying warning. Threat protection policies in Browser Security Plus enforce these settings: safe browsing stays on, the "ask where to save" and download behaviour stays standard, and the user cannot quietly weaken them. Check edge://policy or chrome://policy on a sample PC afterwards — the enforced settings show up there, which is also how you prove the policy landed.
Two gaps deserve plain words. First, a block list knows yesterday's bad files; a brand-new malicious file can pass every list on its first morning — download policy reduces the crowd of attacks, it does not end them, which is why it sits next to your antivirus and not instead of it. Second, files also arrive by USB stick, personal email on a phone, and chat apps. This console governs the browser door. Cover the other doors with their own policies (USB control, email filtering) rather than blaming the browser policy for a hole it never claimed to plug.
Every blocking policy meets its exception: the government portal that only ships its utility as an .exe, the vendor tool accounts genuinely needs. Create the exception route before go-live — a request to IT, a quick source verification, the file fetched on an IT machine, scanned, and handed over. Ten minutes of process saves the policy itself, because the alternative is staff finding their own route, and their own route is a cracked download site. Log exceptions; a file type requested every week is a signal to reconsider the rule, not to keep suffering it.
Download restrictions, risky file types and the exception route — the full threat-protection walkthrough is in the video.
▶️ Watch Full VideoFor most staff, no — they install nothing themselves, and documents, PDFs, images and spreadsheets are not executables. The people who legitimately download tools are IT and developers; give their group a different policy. Roll out to a pilot group first so the one strange exception (a bank utility, a government tool) is found in a test week, not on salary day.
No. It is a door policy, not a guard dog. It stops whole categories of risky files before they land, but a file that is allowed through still needs a real antivirus to inspect it, and a brand-new threat may be on no block list yet. The three layers — download policy, browser safe browsing, endpoint antivirus — exist because each one misses something the others catch.
Renaming does not change what a file is, and policies check the file type and source, not only the name. Determined users have other routes — personal devices, for example — but that is a management and policy matter, not a settings problem. The goal of download control is to stop the routine, accidental infection, which is where almost all real damage starts.