Locking Down Windows

[Manny]

I curently work in a large corp environment. We are
running a combination of Windows Xp & Win2K in an Active
Directory Domain. What is the best way to lockdown
user's desktops? Originally, we placed users in
the "Power Users" Group of the local machine. We figured
this would prevent them from installing software.
However, spyware and certain apps still slip in. We've
tried the "Users" Group, but user's then had problems
running certain apps. We are looking for something that
will prevent the installation of ANY software by users.

Any suggestions would be appreciated.

 

[Robert Moir]

I curently work in a large corp environment. We are
running a combination of Windows Xp & Win2K in an Active
Directory Domain. What is the best way to lockdown
user's desktops? Originally, we placed users in
the "Power Users" Group of the local machine. We figured
this would prevent them from installing software.
However, spyware and certain apps still slip in. We've
tried the "Users" Group, but user's then had problems
running certain apps. We are looking for something that
will prevent the installation of ANY software by users.

Any suggestions would be appreciated.

I'd suggest custom producing your own set of rights and permissions you'd
like users to have in order to allow these legacy apps to run from normal
user accounts, then you can ditch the power user requirement.


--
--
Rob Moir, Microsoft MVP for servers & security
Website - http://www.robertmoir.co.uk
Virtual PC 2004 FAQ - http://www.robertmoir.co.uk/win/VirtualPC2004FAQ.html

Kazaa - Software update services for your Viruses and Spyware.

 

[Roger Abell [MVP]]

Robert is right on. Enable those apps to run as plain Users
members (usually just permissions for the app install dir and/or
reg entries). Even then, with them being Users, they will still be
able to install some things, specifically the drag-and-drop type
installs. The way to fully take control over this is to look at using
Software Restriction Policy.