Re: Prevent users/admin from installing softwares.




To my knowledge, there's no built-in way to directly prevent the
administrator from installing software. However, you can use Software
Restriction Policies (Group Policy Editor > Computer Configuration >
Windows Settings > Security > Software Restriction Policies) to limit
software execution so that software only runs from a set of predefined
paths. By limiting the paths from which software can execute, you may be
able to severely-limit an Administrator's ability to install software.
However, there are obvious problems with this:

1) If you're setting this in Local Group Policy (as opposed to
Domain-level), the Local Administrator can easily remove the Software
Restriction Policies
2) The obvious "hack" is to copy your installation file to a path where
software is permitted to execute, then to install said software to a
permitted location. Whether this is an acceptable risk depends on the
cleverness of your administrators and the sensitivity of your systems.

Beyond this, I don't personally know of a solution that doesn't involve
3rd party software.

Good luck,
Greg Pendergast

-----listbounce@xxxxxxxxxxxxxxxxx wrote: -----


To: focus-ms@xxxxxxxxxxxxxxxxx
From: Rocky <pixscreenpoint@xxxxxxxxx>
Sent by: listbounce@xxxxxxxxxxxxxxxxx
Date: 02/22/2007 07:51AM
Subject: Prevent users/admin from installing softwares.

Hey Guys,

Is there a way to restrict everyone including adminisrator rights
from installing softwares in xp pro? It should be done on registry
or gpedit?

we don't want to use 3rd party softwares like winguard.

Thanks a lot!



Relevant Pages

  • RE: Prevent users/admin from installing softwares.
    ... the machine unless they knew the "local" administrator account password. ... Prevent users/admin from installing softwares. ... How do you stop users from unjoin/rejoin ... Restriction Policies (Group Policy Editor> Computer Configuration> ...
    (Focus-Microsoft)
  • RE: Prevent users/admin from installing softwares.
    ... By default all users in AD shd be able to join up to 10 machines without ... Prevent users/admin from installing softwares. ... Restriction Policies (Group Policy Editor> Computer Configuration> ... the Local Administrator can easily remove the Software ...
    (Focus-Microsoft)
  • RE: Prevent users/admin from installing softwares.
    ... Administrators or Domain Administrators groups, ... Prevent users/admin from installing softwares. ... Restriction Policies (Group Policy Editor> Computer Configuration> ...
    (Focus-Microsoft)
  • URGENT PLZ~~~ ***User Previlege***
    ... i want to grant normal users with privilege ... of installing softwares. ... i should grant in group policy for users. ...
    (comp.os.ms-windows.nt.admin.security)
  • RE: Prevent users/admin from installing softwares.
    ... Let's not forget how easy it is to circumvent the application of Group Policy: ... Unjoin the computer from the domain, reboot, install your software, rejoin. ... Restriction Policies (Group Policy Editor> Computer Configuration> ... the Local Administrator can easily remove the Software ...
    (Focus-Microsoft)