Software install restrictions

[Momo]

Our co. is just about to deploy GPO.

Currently all users are admins on their workstations, and what we'd
like to do is start restricting them from installing software on their
machines....

As I'm aware we can begin by using "software policy" to start limiting
what apps they can run on their machines.

But is their a way of preventing them from installing any further apps
without removing their "admin" rights.....(eventually we will be
heading towards this goal) or will downgrading them to PowerUsers
benefit(they'll probably still be able to install)....

Any thoughts appreciated.....

Momo

 

[Mark Heitbrink [MVP]]

Hi,

But is their a way of preventing them from installing any further apps
without removing their "admin" rights.....(eventually we will be
heading towards this goal) or will downgrading them to PowerUsers
benefit(they'll probably still be able to install)....

There is no simple working solution, because there is no existing
permission "Allow to install Software".
The setup/install of a software is completly depending on the
developer who builds the package.

If you make the users just users on there own PC they still can
install software by using the personal folder as instal path,
some software will then be restricted if this one wants to make
some changes in HKLM.
But a very lot software just works fine if it is extracted from
archiv and copied somewhere.

- make them Users
- work with Software Restriction Policy, set to deny everything
- only define the pathes, where they are allowed to start a program
.... if "personal folder" is not a allowed path, they cant start a
program inside. They still can open mp3, wav, word, excel etc.

Mark

 

[lforbes]

Our co. is just about to deploy GPO.

Currently all users are admins on their workstations, and what
we'd
like to do is start restricting them from installing software
on their
machines....

As I'm aware we can begin by using "software policy" to start
limiting
what apps they can run on their machines.

But is their a way of preventing them from installing any
further apps
without removing their "admin" rights.....(eventually we will
be
heading towards this goal) or will downgrading them to
PowerUsers
benefit(they'll probably still be able to install)....

Any thoughts appreciated.....

Momo

Hi,

Local Admins can do anything on their machines and get around anything
set up by Group Policy. To stop users installing you will have to make
them regular users and then they can’t install.

Is there some special software you have that requires your users to be
Admins? I haven’t run into any software yet I wasn’t able to get
running under a regular user account.

Cheers,

Lara