RE: How to block users from installing other apps

Jason_Irwin_at_Dell.com
Date: 06/27/03

  • Next message: Christopher Ortega: "RE: SP4 installation" 
    To: Jbeauford@mill-max.com, focus-ms@securityfocus.com
Date: Fri, 27 Jun 2003 14:24:43 -0500

    I would find out why they need local admin rights, setup up security audits
    and lock down the box and run through the apps till you get a complete map
    of necessary security. You could then experiment with increasing power users
    rights till you get their apps running then move everyone into the power
    user group. Prolly should start with a good written security policy that
    everyone signs first :-)
    -JI

    -----Original Message-----
    From: Jason Beauford [mailto:Jbeauford@mill-max.com]
    Sent: Friday, June 27, 2003 10:56 AM
    To: focus-ms@securityfocus.com
    Subject: RE: How to block users from installing other apps

    How about a locked down / minimal Terminal Server with Local Admin
    rights on it for the users of this program? This allows for centralized
    administration and monitoring (of users actions/changes etc..) while
    keeping their local WORKSTATIONS free from local admin accounts. This
    way, only the TS is vunerable to the actions of the users.

    Just my thoughts...

    Cheers!

    JMB

    -----Original Message-----
    From: Jane Han [mailto:janehan22@yahoo.com]
    Sent: Wednesday, June 25, 2003 1:22 PM
    To: focus-ms@securityfocus.com
    Subject: How to block users from installing other apps

    Due to several customized inhouse applications, the
    users need to be local aministrator to lauch the
    applications. Since most users are local
    admin, they can download and install applications such
    as games, AOL instant messages...from internet.

    Is it possible to block users from installing
    applications through Group Policy in this case? or
    disable internet explorer?

    Any solutions or suggestions?

    Thanks in advance,
    Jane

    __________________________________
    Do you Yahoo!?
    SBC Yahoo! DSL - Now only $29.95 per month! http://sbc.yahoo.com

    ----------------------------------------------------------------------------
    -
    ---------------------------------------------------------------------------- 

    --
-----------------------------------------------------------------------------
------------------------------------------------------------------------------
  • Next message: Christopher Ortega: "RE: SP4 installation"

    Relevant Pages

    • Re: [FIXED] File Download box unwanted
      ... Logged in as local admin. ... Microsoft MVP (Windows Server: Security) ... users could run network apps without ...
      (microsoft.public.windows.server.security)
    • Re: Automatically making AD users local administrators on computers in SBS 2003
      ... best" when assigning user rights. ... provide the client this account and password. ... can use this special local administrator account. ... > This will automatically give each user that logs in local Admin rights. ...
      (microsoft.public.windows.server.sbs)
    • Re: Removing Local Admin Rights...
      ... > None of our users have admin rights. ... Some software will run only under local admin user accounts. ... > Ethical Hacking at the InfoSec Institute. ... > pen testing experience in our state of the art hacking lab. ...
      (Security-Basics)
    • RE: How to block users from installing other apps
      ... How to block users from installing other apps ... and add their domain account to the local admin group. ...
      (Focus-Microsoft)
    • RE: Local admin password
      ... Subject: Local admin password ... This email was scanned for all viruses by our Security Systems on entering the Easy i network. ... This email has been scanned by the MessageLabs Email Security System. ...
      (Focus-Microsoft)