Re: RE: Can we really block users from installing applications through Group policy?

From: Joshua Feek (jfeek_at_yahoo.com.au)
Date: 10/26/04

  • Next message: Billy Dodson: "802.1x Authentication" 
    Date: Tue, 26 Oct 2004 04:05:12 +0100 (BST)
To: Laura Robinson <larobins@verizon.net>, Paul Aviles <paviles@adjoined.com>, Harlan Carvey <keydet89@yahoo.com>, focus-ms@securityfocus.com

    This is not related to software restriction but a
    method that can be used via group policy to restrict
    the applications that can be installed, software
    restriction only stops the application being launched.

    Within a GPO you can specify that only a cert
    certified applciation can be installed and then
    specify the trusted cert provider. By enforcing this a
    user cannot install unauthorised applications.

    The original question was how to stop users from
    installing apps via a gpo method. This fits the bill
    and works very well, except you have to repackage
    applications to msi format (or anything else) so that
    you can sign the installation with your cert.

     --- Laura Robinson <larobins@verizon.net> wrote:
    > While your reply actually seems to be in response to
    > something other than the message to which it is
    > attached, I did want to comment on a couple of
    > items. First, implementing software restriction
    > policies does not require one to repackage all
    > applications into signed .msi packages- it depends
    > on which of the four methods of restriction you
    > implement. Second, you are only mentioning one way
    > to implement software restriction policies- there
    > are numerous ways of going about it. It's not quite
    > as facile as the description below indicates.
    >
    > Laura
    > >
    > > From: Joshua Feek <jfeek@yahoo.com.au>
    > > Date: 2004/10/18 Mon PM 09:13:01 EDT
    > > To: Laura Robinson <larobins@verizon.net>, Paul
    > Aviles <paviles@adjoined.com>,
    > > Harlan Carvey <keydet89@yahoo.com>,
    > focus-ms@securityfocus.com
    > > CC: chang zhu <cyz2000@yahoo.com>
    > > Subject: Re: RE: Can we really block users from
    > installing applications through Group policy?
    > >
    > > Of course you can though it requires you to
    > package
    > > all applications into MSI format and certify using
    > a
    > > PKI cert. You then config a GPO to only allow apps
    > > that are certified by your cert to be installed.
    > This
    > > will stop dead every other application
    > installation.
    > > You can of course include other certs from verdors
    > to
    > > minimise this repackage requirement
    > >
    > > --- Laura Robinson <larobins@verizon.net> wrote:
    > > > Um, I don't recall Harlan saying that the policy
    > had
    > > > to be applied to *everyone*.
    > > >
    > > > Laura
    > > > >
    > >
    > >
    > >
    > >
    > >
    > >
    > >
    >
    ___________________________________________________________ALL-NEW
    > Yahoo! Messenger - all new features - even more fun!
    > http://uk.messenger.yahoo.com
    > >
    >
    >

            
            
                    
    ___________________________________________________________ALL-NEW Yahoo! Messenger - all new features - even more fun! http://uk.messenger.yahoo.com

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Billy Dodson: "802.1x Authentication"

    Relevant Pages

    • Re: RE: Can we really block users from installing applications through Group policy?
      ... When you repackage your applications into a new ... certificate rule,you add the reference to the cert you ... >> specify the trusted cert provider. ... >> installing apps via a gpo method. ...
      (Focus-Microsoft)
    • Re: RE: Can we really block users from installing applications through Group policy?
      ... Could you please identify the GPO setting in question? ... > user cannot install unauthorised applications. ... > installing apps via a gpo method. ... First, implementing software restriction ...
      (Focus-Microsoft)
    • Re: I WANT MY FP2000 BACK-Fr Alex
      ... > However you needed to have Norton disabled when you installed ... > In general any anti-virus application should be disabled when installing ... > Thomas A. Rowe ... >>>> What other applications do I have. ...
      (microsoft.public.frontpage.client)
    • Re: Whats the Deal with IE8
      ... What third-party firewall? ... applications running in the background when you installed and/or ... I generally follow the same procedure when installing major upgrades. ... 13- Disable your security software. ...
      (microsoft.public.windowsupdate)
    • Re: ATAPI CD-ROM, UNIX"NEW GUY"
      ... >> As of now it is no longer working properly I cannot finnish installing ... Most of the applications you list are available for Mac OSX; ... Select the best operating system to support the applications. ...
      (freebsd-questions)
    • Quantcast