Restrict Software installs on pc

[XP Homie User]

I have a Windows XP Pro SP2 workstation that I would like to restrict local
user accounts from software installs. I thought all that was necessary was
to not give them Administrator rights. But I tested this with a user account
and was able to install software. I'm thinking I need to add a local group
policy but am lost as to how to do so if need be. Any help would be much
appreciated. Thanks in advance.
Homie

 

[Lanwench [MVP - Exchange]]

I have a Windows XP Pro SP2 workstation that I would like to restrict
local user accounts from software installs. I thought all that was
necessary was to not give them Administrator rights. But I tested
this with a user account and was able to install software. I'm
thinking I need to add a local group policy but am lost as to how to
do so if need be. Any help would be much appreciated. Thanks in
advance. Homie

Are you using AD? If so, you shouldn't have any local user accounts at all
other than the built-in stuff like Administrator (and make sure only you
know the password). Your domain users should be users only. Most software
won't install unless you have Admin or Power User rights, but some will. The
place to control things like this is in your domain's group policy, not
local policy.

Try posting in m.p.windows.group_policy for more expert help.

 

[XP Homie User]

My bad. I should have mentioned this is not a domain computer. This is a
stand alone machine.

"Lanwench [MVP - Exchange]"

 

[Lanwench [MVP - Exchange]]

My bad. I should have mentioned this is not a domain computer. This
is a stand alone machine.

Ah. Sorry, that was my mistake .....it's because you mentioned "local user".

You might check out Doug Knox's XP Security Console or Windows Steady State
for some lockdown options.

"Lanwench [MVP - Exchange]"

Are you using AD? If so, you shouldn't have any local user accounts
at all other than the built-in stuff like Administrator (and make
sure only you know the password). Your domain users should be users
only. Most software won't install unless you have Admin or Power
User rights, but some will. The place to control things like this is
in your domain's group policy, not local policy.

Try posting in m.p.windows.group_policy for more expert help.