Re: Creating Custom group for local XP Pro SP2 machine

From: Josh Mikow (jmikow_at_applebyco.com)
Date: 08/19/04 

Date: Thu, 19 Aug 2004 13:41:29 -0700

Doug,

Thanks for the suggestion. I was afraid I wouldn't be able to achieve both
goals with 1 policy.

How would we go about auditing the software installed?

I was thinking of using Norton CleanSweep to monitor what is installed, but
is there a better way to do the same thing?

Josh

"Doug Knox MS-MVP" <dknox@mvps.org> wrote in message
news:ORQzhnihEHA.4092@TK2MSFTNGP10.phx.gbl...
You can use Group Policies to restrict access to the Add/Remove Programs
applet and to prevent installs from MSI installer packages. However, this
will not prevent them from using a direct installer to install software.

You may be better off making them Power Users and simply auditing the
software installed on the computer, and make it clear that software not
provided by your organization is not allowed to be installed. Be prepared
to make an example of the first one you catch. 

-- 
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.
"Josh Mikow" <jmikow@applebyco.com> wrote in message
news:uBCj$EihEHA.3916@TK2MSFTNGP11.phx.gbl...
> Here's what we want to be able to do.  If someone could let me know if it
is
> even feasable that would be great.
>
> Domain user is logged into local Windows XP Pro SP2 machine (mobile laptop
> not always connected to domain).
>
> They are currently setup as a User and not allowed to add/remove programs.
>
> They need the ability to Start/Stop services because of the demos that
they
> run have settings they need to change.
>
> There are also some settings in IE that don't seem to work as a user, but
do
> as Administrator.
>
> Can anyone help me know if it is possible to restrict add/remove programs
> but allow start/stop services?
>
> Thanks,
>
> Josh Mikow
>
>

Relevant Pages

  • Re: Administrator Consoled in Can not install software
    ... That would tell you exactly which policy has the ... Components - Windows Installer ... MCSE, CCEA, Microsoft MVP - Terminal Server ...
    (microsoft.public.windows.terminal_services)
  • Re: Administrator Consoled in Can not install software
    ... Thanks for your help it was the local policy that was still turned on. ... Components - Windows Installer ... MCSE, CCEA, Microsoft MVP - Terminal Server ...
    (microsoft.public.windows.terminal_services)
  • Re: assign permission set
    ... Isn't there a requirement on what version of Microsoft Installer itself is ... > policy it does so at some risk. ... > How do I distribute the policy deployment package across my enterprise? ... Start the Group Policy Editor. ...
    (microsoft.public.dotnet.security)
  • Re: The system administrator has set policies to prevent this inst
    ... I've also checked every GPO for a Software Restriction Policy and none are ... shows that a Group Policy setting for Windows Installer is disabled?? ... templates/Windows components/Windows installer and set disable Windows ...
    (microsoft.public.windows.server.security)
  • Re: Hosted WinForms Controls and CAS
    ... this is part of an msi installer project - and should get you ... throw new ApplicationException("Failed to find the machine policy ... // that includes whatever permissions we're granting ... CodeGroup cg = new UnionCodeGroup( ...
    (microsoft.public.dotnet.security)
Loading