Re: Can we really block users from installing applicationsthrough Group policy?

From: Thor (thor_at_hammerofgod.com)
Date: 10/10/04

  • Next message: Paul Aviles: "RE: Can we really block users from installing applications through Group policy?" 
    To: "Miroslaw Slawek Chorazy" <mchorazy@depaul.edu>, <focus-ms@securityfocus.com>, <cyz2000@yahoo.com>
Date: Sat, 9 Oct 2004 23:46:35 -0700

    IIRC, the OP's clients are XP (I seem to remember Win2k as well, but I am
    programed to ignore that ;)

    SAFER restrictions are what you want. I've meant to write up a "how-to" on
    that (as I cover it in my Blackhat training) but I just can't find the the
    time to do so... Deb Shinder (The wife of Tom, the dude that own's
    ISAserver.org) has gone out of her way to provide the following edu--

    http://www.microsoft.com/technet/security/prodtech/winclnt/secwinxp/xpsgch06.mspx

    hth

    t

    ----- Original Message -----
    From: "Miroslaw Slawek Chorazy" <mchorazy@depaul.edu>
    To: <focus-ms@securityfocus.com>; <cyz2000@yahoo.com>
    Sent: Friday, October 08, 2004 9:51 AM
    Subject: Re: Can we really block users from installing applicationsthrough
    Group policy?

    > Blocking users from installing applications is really a comprehensive
    > group of related policies not limited to just Group Policy Objects.
    >
    > Some of them are;
    > 1. User rights on the local computer
    > 2. ACLs on Directory Sturctures
    > 3. ACLS on Registry Hives ( especifically HKLM and HKCR )
    > 4. Software Restriction Policies or simmilar blocking mechanism
    >
    > Slawek
    >
    >>>> chang zhu <cyz2000@yahoo.com> 10/8/2004 07:45 >>>
    > Hi, all
    >
    > The users are not local administrators. We configure
    > group policy to prevent user installs but it seems
    > that it blocks only .msi packages. Users still can
    > install applications through ex. setup.exe...Can we
    > really block users from installing applications
    > through Group policy?
    >
    > Any idea or thoughts on this?
    >
    > Plus, if we need to block users from saving .mp3 file
    > on their computers, can we do it through group policy?
    >
    > we are on windows2000 and XP environment.
    >
    > Thanks always,
    >
    > Chang
    >
    >
    >
    >
    >
    >
    > _______________________________
    > Do you Yahoo!?
    > Declare Yourself - Register online to vote today!
    > http://vote.yahoo.com
    >
    > ---------------------------------------------------------------------------
    > ---------------------------------------------------------------------------
    >
    >
    >
    > ---------------------------------------------------------------------------
    > ---------------------------------------------------------------------------
    >
    >
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Paul Aviles: "RE: Can we really block users from installing applications through Group policy?"

    Relevant Pages

    • RE: Block One URL in Group Policy
      ... >> Is it possible to block users from going to a particular website in ... >> group policy? ... I need to restrict access to one website on a group of ...
      (microsoft.public.win2000.group_policy)
    • Re: Blocking certain programs for certain usergroups
      ... ok so I can use this to block users from using Microsoft Office for exampel? ... > You should use the Software Restriction resource from Windows Server 2003. ... >> How do I configure The group policy or whatever, ...
      (microsoft.public.windows.server.active_directory)
    • Re: Block Internet Explorer
      ... > Is there a way to block users from using Internet Explorer ... > with Group Policy? ... > users without blocking the workstation. ...
      (microsoft.public.win2000.group_policy)
    • Block Internet Explorer
      ... Is there a way to block users from using Internet Explorer ... with Group Policy? ... users without blocking the workstation. ...
      (microsoft.public.win2000.group_policy)