GPOs to restrict users from installing "unspecified" software

[tengel82]

How can I use GPOs to restrict users from installing "unspecified"
software on their client computers, while they are local administrators
on their client computers.

We are using a Windows 2000 domain, with windows 2000 servers and
Active Directory

 

[Tomasz Onyszko [MVP]]

How can I use GPOs to restrict users from installing "unspecified"
software on their client computers, while they are local administrators
on their client computers.

They are administrators - simply You can't deny something to this users
on local machine - If you put NTFS ACLs they will take ownership of the
folders and change them .. so the first thing is to take them out of the
local admin group.

 

[tengel82]

There is one main program that we use for our company. It is set up so
that it automatically "installs" when you open up that software. That
way if the software is updated after hours, when logging on and opening
the software, everyone will always be using the most updated version of
the software. To be able to "install" the most updated version when
you open the software they have to be administrators, right?

 

[Oli Restorick [MVP]]

Sounds like poor design of that application to me.

As Tomasz says, an administrator is an administrator. All you can attempt
to do is to put enough hurdles in your users' way that they don't try to
install software. An administrator can always undo anything you do.

One option, if you were using Windows XP, would be to use software
restriction policies.

Hope this helps

Oli

 

[tengel82]

Unfortunately there's not a whole lot I can do to change the design of
the application, so are there any suggestions for where I should go
from here.

 

[tengel82]

Unfortunately there's not a whole lot I can do to change the design of
the application, so are there any suggestions for where I should go
from here.

 

[ALEX]

I was told that Generally the member of Power Users Group have the rights of
software installation.
In additional to "Security Template",anyone can show me how to use?

 

[tengel82]

Unfortunately there's not a whole lot I can do to change the design of
the application, so are there any suggestions for where I should go
from here.

 

[Oli Restorick [MVP]]

I'd say you have two choices. One is to remove users from the local admin
group and deploy updates to the software manually. The other is to upgrade
to Windows XP and use software restriction policies to make it awkward (but
not impossible -- they're administrators after all) for them to install new
software.

Oli