using GPO to prevent software installs

[Derek Marshall]

I realize Windows 2003 has "Software Restriction Policy", but is there
anything analogous for Win 2K domains? Even 3rd party tools? We run a lot of
legacy apps (who doesn't) and excluding everyone from the local admin group
is not always an option. Besides, a lot of apps downloaded from the Internet
can be "installed" by users without Admin privileges.

There are many band-aid solutions (like preventing users from running
SETUP.EXE via GPO, for example), but I can't believe that there isn't a good
solution out there.

d.

 

[Steven L Umbach]

There may be third party applications that can try to lockdown a user, but I
think the money is better spent on upgrading to XP Pro and you can use
Software Restriction Policies on Windows XP Pro computers in a W2K domain by
upgrading the admin templates as described below. I know of no other way
through Group Policy than the ways you mention of either disallowing a list
of Windows applications or allowing only those applications/executeables in
the allowed Windows application list. --- Steve

http://www.microsoft.com/windowsxp/pro/using/itpro/managing/upgradetemplate.
asp

 

[Mike Kline]

Derek,
I also like XP's software restriction policies but you also asked
about third party proucts

Sanctuary may help you out, you may have heard of it when it was
called SecureEXE

http://www.securewave.com/

 

[Derek Marshall]

I also looked at http://www.faronics.com/html/Freezex.asp. My fear in a 3rd
party app is the conflict that would undoubtedly arise when using GPO to
deploy apps. I will probably rely on written policy and moving to XP soon.

D.