Re: Preventing users installing programms...?

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 09/01/04 

Date: Wed, 01 Sep 2004 20:13:50 GMT

First off if at all possible make sure these users are only regular users and not
local administrators or else it is usually a lost cause.

There is a Group Policy setting under user configuration/administrative
templates/system where you can populate the disallowed Windows application list. Be
sure to read it's full explanation and add the executeables for those common
applications to the list and also add install.exe and setup.exe. Since you will be
using Local Group Policy the these restrictions will apply to ALL users on that
computer and will need to be temporarily disabled to install legitimate software. If
a user is able to rename an executable they will be able to bypass that restriction.
A more extreme measure that I have tried on myself but is not 100 percent tested is
to make sure that users can not write to any folder other than their profile and then
use ntfs special permissions to deny the user execute permissions to "files only" for
the profile folder. Depending on the user, they may be able to figure out that they
can change permissions back to allow execute. Otherwise consider upgrading to XP Pro
where it is easy to lockdown users to authorized applications only using Software
Restriction Policies, even local administrators.. --- Steve

"Paul K" <anonymous@discussions.microsoft.com> wrote in message
news:453b01c4905c$a44c95d0$a501280a@phx.gbl...
> hi all..
>
> Can anyone help me???
> Ive a standalone win 2000pro workstation, ive locked it
> down tight but i cant find a way to prevent a user
> installing "messenger" "AOL chat" and any other programs
> she wants to run.
>
> I would love to find a way of preventing my users
> installing all, and any programs, on this STAND ALONE
> workstation.
>
> Any help greatly appreciated
>
> Yours PaulK

Relevant Pages

  • Solaris 10 autofs directory permissions - Solution
    ... the fact that my map file has 755 permissions not 644. ... If the execute permission is set, it becomes an executable map which is ... map is expected to return the content of an automounter map ...
    (SunManagers)
  • Re: Rights to execute jobs?
    ... Does anyone know if the rules surrounding stored procedure permissions apply ... Does this apply to a proc calling sp_start_job so that I ... raise the alert, so it could be anyone on the server. ... is that a group needs to not be an admin but still be able to execute ...
    (microsoft.public.sqlserver.security)
  • Re: Newbie
    ... I will now tell you some basic commands. ... Easy file has rights and a owner. ... file and who may execute it. ... The last three characters are about the permissions of user ...
    (alt.linux)
  • Re: Execute Persmission denied on object sp_OACreate
    ... SQL Server doesn't check permissions on indirectly referenced objects as ... You can prevent ad-hoc execution of powerful master database procs while ... >I have a user who has execute permissions on a store procedure in a>database> which in turns executes 4 stored procedures in the master database. ...
    (microsoft.public.sqlserver.security)
  • Re: remove user exe execute permission
    ... be able to read or execute the file. ... In NTFS grant - read and execute ... remove the 'read' permission of that folder. ...
    (microsoft.public.windows.server.security)