Stopping users installing software in ADS

Computerkid · 07-21-2004, 08:17 AM

Hi,

How do I go about preventing a group of users from installing any software locally on their PCs using an ADS group policy?

We are having loads of problems with users installing all sorts of shareware, games, etc on their PCs and would like a way of blocking this. All the users have got local admin permissions on the PCs (don't ask!) so at the moment they can do whatever they fancy. We need to be able to put them in a group to block this access and put the true administrators in another group allowing them to install legitimate software (by remote control if necessary). It would obviously be better to do this through ADS rather than having to go round changing all the local PCs.

Thanks in advance for your suggestions!

Worked4me · 07-23-2004, 08:20 PM

You will need to put all the users in a OU and apply a couple of policies.
Go to start, run, gpedit.msc. In Computer Configuration, Windows Installer, and
set the Disable Windows installer and Prevent user Installs to Enabled.

It is obviously better that only the trusted and needed Users be given the
Local Computer Administrator privledge. This should be especially true if the
Admin privledge is causing you to routinely have to troubleshoot problems with
their computers by them abusing the privledge.

Good Luck.

07-21-2004, 08:17 AM	#1 (permalink)
Computerkid Registered User Join Date: Jul 2004 Posts: 1 OS: XP	Stopping users installing software in ADS Hi, How do I go about preventing a group of users from installing any software locally on their PCs using an ADS group policy? We are having loads of problems with users installing all sorts of shareware, games, etc on their PCs and would like a way of blocking this. All the users have got local admin permissions on the PCs (don't ask!) so at the moment they can do whatever they fancy. We need to be able to put them in a group to block this access and put the true administrators in another group allowing them to install legitimate software (by remote control if necessary). It would obviously be better to do this through ADS rather than having to go round changing all the local PCs. Thanks in advance for your suggestions!

07-23-2004, 08:20 PM	#2 (permalink)
Worked4me Registered User Join Date: Jul 2004 Location: South Posts: 230 OS: Win 2k, XP	You will need to put all the users in a OU and apply a couple of policies. Go to start, run, gpedit.msc. In Computer Configuration, Windows Installer, and set the Disable Windows installer and Prevent user Installs to Enabled. It is obviously better that only the trusted and needed Users be given the Local Computer Administrator privledge. This should be especially true if the Admin privledge is causing you to routinely have to troubleshoot problems with their computers by them abusing the privledge. Good Luck.