Using GPO to prevent users from installing applications

[Guest]

Hi,

I'm not sure if this is the correct newsgroup to ask this question, but we
want to deploy a group policy that prevents users (domain users and users
with local admin rights) from installing any applications on their computers.

I saw that you can with in group policy: 'Hide Add new programs page',
'Prevent removable media source for any install' and 'Always install with
elevated privileges'

Would enabling these policies be enough to prevent domain and local admin
users from installing apps on their computers or is there more that needs to
be configured?

Thanks,
Chris

 

[Steven L Umbach]

No that would not help very much if at all. Keep in mind that it can be
futile to try and restrict a knowledgeable user that is a local
administrator who has the desire to undo the restrictions. Your best bet
would be to use Software Restriction Policies but any local administrator
can bypass SRP by booting into Safe Mode if they know that and my guess is
most do not so it may be worth a try. The link below explains more on
Software Restriction Policies and you may want to rethink users that are
local administrators as often there are workarounds to do such. --- Steve

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx
--- Software Restriction Policies