Re: restricting software installation

param_at_community.nospam
Date: 07/28/05 

Date: Wed, 27 Jul 2005 22:16:58 -0500

How would I go about setting up an OU and will that new OU disrupt my SBS
configuration? I know SBS does a bunch of unique A/D stuff..

TIA!

"Roger Abell [MVP]" <mvpNoSpam@asu.edu> wrote in message
news:%236ot67xkFHA.3164@TK2MSFTNGP15.phx.gbl...
> Nathan is correct, that if you client machines are XP at a relatively
> native state as per initial install, then just making the domain users
> log in as on Users group members will go a long way to restricting
> their install capabilities (not stop it totally however).
> The main vehicle today to go the next step is the same software
> restriction policies you have been trying. Just take a machine in
> a new test OU, a test domain user account also in the OU, and
> evolve your software restrictions in a new GPO that is linked to
> that test OU. When you get the desired result, link the GPO to
> the OU that holds the real client machines.
>
> --
> Roger Abell
> Microsoft MVP (Windows Server System: Security)
> MCDBA, MCSE W2k3+W2k+Nt4
> <param@community.nospam> wrote in message
> news:O4Rd7HskFHA.1996@TK2MSFTNGP10.phx.gbl...
>> Hi all,
>>
>> We run a single Server 2003 domain running on SBS2003. What I want to do
>> is restrict users from installing programs on their machine. If they want
>> to install a program they would have to call an Admin to do it. Ideally,
>> it would be nice if I can have an approved list of programs that they can
>> install, and anything not in the list they would have to contact an
>> admin. Any suggestions/best practices on this? I have tried messing with
>> the Software Restriction Policies in the gpedit tool, but that ended up
>> giving all kinds of errors on the machines including error messages when
>> Outlook was opened. Probably because of Adobe Professional plugins that
>> get installed into Outlook & Office products.
>>
>> thanks!
>>
>
>

Relevant Pages

  • Re: restricting software installation
    ... that if you client machines are XP at a relatively ... native state as per initial install, then just making the domain users ... their install capabilities. ...
    (microsoft.public.windows.server.security)
  • Re: Users dont have permission to install software?
    ... > they do get the admin rights to their machines. ... We need another 'mode', such as 'install only mode', where a user can login ... Les Connor [SBS Community Member - SBS MVP] ...
    (microsoft.public.windows.server.sbs)
  • Re: Virtual server virtual PC
    ... My VMWare Host machines are not all too powerful of choc full of ram, ... The Virtual SBS external NIC is bridged to ... SBS I would want to be able to run SBS, maybe another server, and probably ... I take it you can install an OS to the hardware, ...
    (microsoft.public.windows.server.sbs)
  • Re: Simple way to how domain users log on as restricted users?
    ... restricted users, or is there more than this software install ... Some software will install as users for use by the ... machines using NTFS? ... >>This makes all members of Domain Users local restricted ...
    (microsoft.public.windowsxp.security_admin)
  • I did not install "fax service" on fresh SBS install but now I want to use it. How can I install?
    ... When I built my SBS box I elected to NOT install fax services. ... hindsight I think this was a mistake since it has been requested. ... have the fax only users receive this email via their fax machines. ...
    (microsoft.public.windows.server.sbs)