Re: Re: Can we really block users from installing applications through Group policy?

From: Laura Robinson (larobins_at_verizon.net)
Date: 10/14/04

  • Next message: Matt: "Re: Can we really block users from installing applications through Group policy?" 
    To: Tibor Veres <tibor.veres@gmail.com>, <focus-ms@securityfocus.com>
Date: Thu, 14 Oct 2004 14:06:46 -0400

    Frankly, the easiest way to address this problem would be to upgrade to Win2K3, which allows software restriction policies to be implemented. :-)

    Laura
    >
    > From: Tibor Veres <tibor.veres@gmail.com>
    > Date: 2004/10/08 Fri PM 01:55:18 EDT
    > To: focus-ms@securityfocus.com
    > Subject: Re: Can we really block users from installing applications through Group policy?
    >
    > can't you just block running any file not owned by Administrator and a
    > few other trusted users?
    >
    >
    > On Fri, 8 Oct 2004 11:56:09 -0300, Augusto Paes de Barros
    > <apbarros@gmail.com> wrote:
    > > Yes, through ACLs on registry keys like "Software". IF the users
    > > have only read only access on some of them installation packages won't
    > > work. However, remember that a lot of software don't need a "formal"
    > > installation process. You can play with the ACLs on the Program Files
    > > folder too, but I believe that it might break some apps.
    > >
    > > Regards,
    > >
    > >
    > >
    > >
    > > On Fri, 8 Oct 2004 05:45:31 -0700 (PDT), chang zhu <cyz2000@yahoo.com> wrote:
    > > > Hi, all
    > > >
    > > > The users are not local administrators. We configure
    > > > group policy to prevent user installs but it seems
    > > > that it blocks only .msi packages. Users still can
    > > > install applications through ex. setup.exe...Can we
    > > > really block users from installing applications
    > > > through Group policy?
    > > >
    > > > Any idea or thoughts on this?
    > > >
    > > > Plus, if we need to block users from saving .mp3 file
    > > > on their computers, can we do it through group policy?
    > > >
    > > > we are on windows2000 and XP environment.
    > > >
    > > > Thanks always,
    > > >
    > > > Chang
    > > >
    > > >
    > > > _______________________________
    > > > Do you Yahoo!?
    > > > Declare Yourself - Register online to vote today!
    > > > http://vote.yahoo.com
    > > >
    > > > ---------------------------------------------------------------------------
    > > > ---------------------------------------------------------------------------
    > > >
    > > >
    > >
    > >
    > > --
    > > Augusto Paes de Barros, CISSP
    > > http://www.paesdebarros.com.br
    > >
    > > ---------------------------------------------------------------------------
    > > ---------------------------------------------------------------------------
    > >
    > >
    >
    >
    > --
    > Tibor Veres
    > tibor.veres@gmail.com
    >
    > ---------------------------------------------------------------------------
    > ---------------------------------------------------------------------------
    >
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Matt: "Re: Can we really block users from installing applications through Group policy?"