Restrict software installation to domain adminstrators

[Darin]

Is there a setting in AD where you can restrict the
ability to install software to domain administrators? Or
prevent joe-user from browsing the Internet, seeing a
program he wants, and selecting the option to "Run from
current location".

I currently have a group policy that prevents saving to
disk, but the way around it is to run from current
location.

If so, where is it?

Thanks in advance.

 

[Matjaz Ladava [MVP]]

When you are setting security on systems you have to consider different
approaches. Not everything is a single click operation. If you want to
prevent your users from installing software, then don't make them local
administrators on their machines. Only Administrators can install the
software because of privileges required by this operation.
To prevent user from browsing the internet, you can use filtering at
firewall level. MS ISA server has the ability to control which user can do
what on the internet.
Preventing to run specific application or saving to disk is achieved by
setting up security on files/folders and thus preventing your users from
doing that.

--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)