Un-restricting access to Add/Remote Programs

[Guest]

Over a year ago I used Windows XP Administration Policy to prevent my users
adding programs to a home-used laptop - because it had been used to install
un-authorised software.

I now need to undo what I did (laptop back at base) and cannot see the
option I enabled/disabled in the Administration Policy - I've looked through
the list twice and still can't see it - I know I didn't do anything
complicated - just enabled/disabled and option and that's it !

Please can you help me find the option as I need to remove the anti-virus
software and replace it with our new software - and I can't !!

I will be very grateful for your help.

Regards,
Julia

 

[Steven L Umbach]

We need more details such as is this XP Home or XP Pro and if it is XP Pro
is the computer a member of an Active Directory domain? Also can you be more
specific about what you mean by administration policy as in do you mean
Local Security Policy, Group Policy, Software Restriction Policy, etc. Also
make sure the user that is installing/uninstalling the software is logged on
as a local administrator. If you believe it is Group Policy you can run the
command rsop.msc in the run box on the computer to see Group Policy settings
applied if you expand the folders shown in the report list.

Steve

 

[Guest]

I didn't mention the OS because I thought that I had entered an XP Pro
specific forum.

The computer is a member of an Active Directory domain on our network.

I really am not sure what policy I changed as it was a very, very long time
ago and unfortunately I didn't document the steps I took because I didn't
expect to need to undo the steps and it was such a simple thing to do I
didn't realise that undoing the change would present any difficulty at all
and certainly didn't think that I'd have any difficulty asking in a Tech
Support forum for the steps to undo.

The Policy I believe I changed (I can't see any others it could be) is in
Security Options in Local Policy after choosing "Local Security Policy" in
Administrative Tools.

I do hope I have given you enough info to allow you to help me.

If not, for now it would help if I can find another way to remove Symantec
Client Security from the PC to allow my new Anti Virus software to update and
run. I guess I may need to call Symantec for an answer to this question .....

Regards,
Julia

 

[Steven L Umbach]

I am pretty familiar with the security options in Local Security Policy and
don't believe there is any setting there that is causing the problem for
installing/removing applications [unsigned drivers maybe]. Now Software
Restriction Policies under Local Security Policy could be a potential area
of restriction.

However I believe Group Policy settings may be an issue and that is why I
suggested running rsop.msc on the computer. Group Policy can be managed via
local Group Policy [gpedit.msc] or domain level Group Policies and rsop.msc
would indicate which GPO is applying the setting.

There is a setting under user configuration/administrative templates/control
panel/add and remove programs that can hide various applets. The other one
that may be an issue is restrictions to Windows Installer. There are
settings for that under both computer configuration and user configuration -
administrative templates/windows components/windows installer such as
disable Windows Installer and prevent user installs which if enabled would
prevent installs and removal of .msi package applications.

Steve

 

[Guest]

Hi Steve,

Thanks very much for these suggestions which I will check out when I get to
the office today.

In the meantime, I'm delighted that I've been able to resolve my immediate
and pressing problem which was that I couldn't uninstall Symantec software
and therefore get my new anti-virus software Sophos to update and protect my
computer. I phoned Symantec and they gave me a tool that removed it and
allowed Sophos to reactivate again.

Of course I still want to undo this setting for the future so I hope your
email points me to the setting and I certainly won't be daft enough to change
a policy setting without documenting what component I went into and what I
changed ever again !! :-(

Thanks for your patience in trying to help me in what seems a much trickier,
more complex area than I ever imagined it was !


Regards,
Julia

I am pretty familiar with the security options in Local Security Policy and
don't believe there is any setting there that is causing the problem for
installing/removing applications [unsigned drivers maybe]. Now Software
Restriction Policies under Local Security Policy could be a potential area
of restriction.

However I believe Group Policy settings may be an issue and that is why I
suggested running rsop.msc on the computer. Group Policy can be managed via
local Group Policy [gpedit.msc] or domain level Group Policies and rsop.msc
would indicate which GPO is applying the setting.

There is a setting under user configuration/administrative templates/control
panel/add and remove programs that can hide various applets. The other one
that may be an issue is restrictions to Windows Installer. There are
settings for that under both computer configuration and user configuration -
administrative templates/windows components/windows installer such as
disable Windows Installer and prevent user installs which if enabled would
prevent installs and removal of .msi package applications.

Steve

I didn't mention the OS because I thought that I had entered an XP Pro
specific forum.

The computer is a member of an Active Directory domain on our network.

I really am not sure what policy I changed as it was a very, very long
time
ago and unfortunately I didn't document the steps I took because I didn't
expect to need to undo the steps and it was such a simple thing to do I
didn't realise that undoing the change would present any difficulty at all
and certainly didn't think that I'd have any difficulty asking in a Tech
Support forum for the steps to undo.

The Policy I believe I changed (I can't see any others it could be) is in
Security Options in Local Policy after choosing "Local Security Policy" in
Administrative Tools.

I do hope I have given you enough info to allow you to help me.

If not, for now it would help if I can find another way to remove Symantec
Client Security from the PC to allow my new Anti Virus software to update
and
run. I guess I may need to call Symantec for an answer to this question
.....

Regards,
Julia