Preventing Users from Installing Programs

[Peter Fitzgerald]

I am managing a small network with Windows XP
workstations. Users on the stations need to be local
administrators, because of particular software
applications, but we would like to prevent the users from
installing any new programs. Does anyone know a way to
accomplish this?

 

[IBTerry [MSFT]]

If the users are an administrator of the machine then they will always be
able to install software.
I would recommend using Regmon and Filemon from SYSINTERNALS.COM to
determine what specific permissions a non-admin user needs to run the
particular applications you referenced.
Regmon and Filemon will show you where the application are reading/writing
from the registry/file system...once you know this information you can open
up the permissions on those reg keys/files to allow non-admin users access
to these locations.

http://www.sysinternals.com/ntw2k/utilities.shtml

IBTerry [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Guest]

If it's just one or two apps that require admin rights you might want to consider Torgeir Bakken's (MVP) Nov. 21, 2002 posting in microsoft.public.win2000.security. He cites 3 links to s/w that might be helpful
http://www.quimeras.co
http://www.netexec.d
http://www.mast-computer.d
If it's OK to have the apps run with a different account you can lower the privs given to your end users and have those apps run at higher privs. And of course check these apps and how you use them to configure your own apps to make sure you don't leave anything open

----- Peter Fitzgerald wrote: ----

I am managing a small network with Windows XP
workstations. Users on the stations need to be local
administrators, because of particular software
applications, but we would like to prevent the users from
installing any new programs. Does anyone know a way to
accomplish this