Re: Stop Installiing Everything

From: Gcorpuz (Gcorpuz_at_discussions.microsoft.com)
Date: 11/30/04 

Date: Mon, 29 Nov 2004 19:27:06 -0800

Create an OU for machines and users, Now. you need to remove all domain users
from the Admin group. Create a Security Group , say sUsersGroup and all the
Standards users to this group.

All machines must moved to the machine's OU
All users must be moved to the Users OU
Apply GPo on both OU's.

Don't edit the Default Domain Group Policy...Create the GPO from the OU
itself

Here, you can disable their access..MSI install or any legacy applications...

Good Luck..

"Danny Sanders" wrote:

> > Right now they all run as administrator on thier own machines, as well.
> > I'm pretty sure I have to change that.
>
>
>
> Start by removing them from the local admin group and only adding only
> "certain people" to the administrator group.
>
>
> > what else can I do, and can I do it as a policy and if so where?
>
> Start by removing them from the local admin group. Test.
>
>
> > I also need to enable only certain people to install stuff,
> > such as the administrator.
>
>
> Add only the users that need to install apps to the admin group.
>
> hth
> DDS W 2k MVP MCSE
>
> "James W. Long" <JamesLong@Dunhamshq.com> wrote in message
> news:CHJqd.25804$Rf1.20338@newssvr19.news.prodigy.com...
> >
> > Dear All:
> >
> > How can I prevent my W2K domain users from installing anything?
> >
> > Right now they all run as administrator on thier own machines, as well.
> > I'm pretty sure I have to change that.
> >
> > what else can I do, and can I do it as a policy and if so where?
> >
> >
> > I also need to enable only certain people to install stuff,
> > such as the administrator.
> >
> >
> > Thank you in advance,
> > James W. Long
> >
> >
> >
> >
> >
> >
> >
> >
> >
>
>
>

Relevant Pages

  • SUS group policy
    ... I've had my sus policy working for about a year now, ... admin group of their machines, ... auto-restart for scheduled automatic updates installation' ... of the local admin group in order to receive the no option ...
    (microsoft.public.win2000.active_directory)
  • Re: Active directory migration tool, access denied
    ... The machines are on, but not logged in. ... > Is the domain admin group part to the computers local admin group? ... >> transfer the computers I get access denied when trying to launch the ... >> migration agent on the client computers. ...
    (microsoft.public.windows.server.sbs)
  • Re: Strange Niggles
    ... All the machines do have the domain admin group added to the ... >> I have put in an SBS2K3 server and then connected all the machines to it. ...
    (microsoft.public.windows.server.sbs)
  • Re: pam ldap limit authentication
    ... > ACL that would only allow =rx to people in your admin group by ... >> I have a suse linux machine which authenticate users to ldap, ... >> machines to just the system admins. ... >> The machines hosts different web sites which users accessed from there ...
    (alt.os.linux.suse)
  • Re: restricting software installation
    ... How would I go about setting up an OU and will that new OU disrupt my SBS ... > native state as per initial install, then just making the domain users ... > their install capabilities. ... > the OU that holds the real client machines. ...
    (microsoft.public.windows.server.security)
Loading