Re: Prevent user to install software

From: Cahya (anonymous_at_discussions.microsoft.com)
Date: 10/08/04 

Date: Thu, 7 Oct 2004 19:07:20 -0700

Cary,

Thanks for your explanation. Actually I was managing
Windows 2000 network for a year. In the last year I try
to set user just the User, not local admin but since that
I get a lot of complain from my user until I set back
them as local admin.

This Week I try to remove them from local user again
after I (little) understand how to using GPO to manage
user. But this 3 days I get alot of complain again like:

1. Some user cannot open email attachment like Winzip,
jpg because registration error when try to open using MS
Picture Manager.

2. One of my user still using DOS application and that
mean I have to set printer to LPT1 using NET USE command.
It's ask for user and password but not if I set as local
admin.
3. My mobile user cannot change their IP when they go to
the branch which is still using static IP.

That what I get for three days. So, May be you can give
another solution the best setting for User?

Best Regards,
Cahya

>-----Original Message-----
>Cahya,
>
>As the other two posters have already pointed out, how
exactly do you plan
>to accomplish something like this? If the domain user
account object is a
>member of the computer's local Administrators group how
do think that the
>domain user account could be prevented from installing
software on that
>machine? If your domain user account object is a member
of the local
>Administrators group then you have all of the
permissions to the file
>directory and registry that are necessary to install
software as it is the
>permissions to the file directory and registry that is
preventing the domain
>user account object from installing software in the
first place.
>
>I am not sure if you know that by default the Domain
Users group is a member
>of the Users local group on all WIN2000 and WIN XP Pro
systems. And,
>naturally, all domain user account objects - save a few -
 are members of the
>Domain Users group. This ( the local Users group ) is a
very restrictive
>group.
>
>As both of the previous posters have correctly asked,
what is it that you
>are trying to accomplish? We might be able to help you
get to where you are
>trying to get without having to do something that is
going to ultimately
>cause you a whole bunch of problems. I speak from
experience ( where I
>used to work - in a 300+ environment - my colleagues
would often log on as
>local Administrator and change the local group
membership of the domain user
>account object from Power Users to Administrators and
forget to change that
>back when they were finished.....lots of stupid things
happened on those
>systems, like people deleting their FONTS folder in
order to make more room
>for their music files or, er, 'pictures'. And that is a
tame example of
>what sort of thing would happen ).
>
>You could also go to http://www.sysinternals.com and use
both filemon and
>regmon to see what registry entry / entries are causing
your a problem (
>assuming that you are trying to install software and are
being told that you
>have to be a member of the local Administrators to do
so ).
>
>HTH,
>
>Cary
>
>
>
>"Cahya" <anonymous@discussions.microsoft.com> wrote in
message
>news:3de901c4ac5e$5fe01200$a501280a@phx.gbl...
>> Dear,
>>
>> I want make all user as local administrator member but
>> want to prevent them to install new software in their
PC.
>>
>> What's setting I have to change in GPO?
>>
>> Thanks,
>> Cahya
>
>
>.
>

Relevant Pages

  • Re: Rights on Xp in 2000 Domain
    ... few users could not run MS Access 2000 unless they were a member of the ... local Administrators group. ... > systems Admin group and couldn't do it, ... >> Another idea is for you to install all of the software that they are ...
    (microsoft.public.win2000.active_directory)
  • Re: How2: User Rights on Domain but Admin Rights on Computer
    ... You can add domain users to the local Administrators group with ... Mathworks MATLAB for example install their services. ... able to run it even if he is just a member of domain users group. ...
    (microsoft.public.windows.server.security)
  • Re: Local User allowed to install Printers
    ... > member of the local users group be given explicit rights to install print ... Do you have a way to allow this and still keep the domain user a ...
    (microsoft.public.win2000.group_policy)
  • Re: Outlook install with SBS 2003
    ... I am pretty sure the user is a member of both Domain Administrators and Local Administrators but will check again. ... Hi Steve, ... computer and than install Outlook. ...
    (microsoft.public.windows.server.sbs)
  • Re: WinXP Security
    ... Not a member of any domain. ... of a sudden I went to install a modem, and it did not let me, even though I ... was a member of the local administrators group. ...
    (microsoft.public.windowsxp.security_admin)
Loading