Re: Restrict Users from Installing programs

From: Herb Martin (news_at_LearnQuick.com)
Date: 03/26/04 

Date: Fri, 26 Mar 2004 08:56:27 -0600

"Dankwa" <anonymous@discussions.microsoft.com> wrote in message
news:13de001c4133d$82db7610$a301280a@phx.gbl...
> I use a windows 2000 Professional on a small network in a
> workgroup so all the User can use all the resources on the
> network.
> My problem is that User are now installing all kind of
> programs on their computers.
> I will want to restrict them from downloading and
> installing any programs on theeir computers.
> I know that can be done with gpedit.msc on individual
> computers, but how do I do that.

Actually this is pretty hard. In some sense it cannot be done
(for ordinary users) or it is fairly complex to approach.

First, use a firewall or Proxy server with filters to STOP the
downloading or even take away Internet privilege -- ISA is
great for this, allowing you to control access to the Internet
by user or group membership.

Second user permissions to control WHERE the user can
place items but understand if you give them a "HOME" or
My Documents directory they are going to be able to WRITE
to the drive and that's all many programs take.

You can also try removing the DEFAULT permissions for
EXECUTE from the "Advanced and Special" permissions without
removing READ etc. Perhaps by making a Group and denying
execute explicitly. This only truly works if you own the directory
and your users don't know how to change permissions (the owner
can always change permissions if they can find the tools.)

You can use Software restriction policy which is the closest to
what you really want but this is touchy to set up for large numbers
of users -- combine it with permissions so that only those marked
by signature in the locations the users can control can work.

You might also consider "quotas" but that is a brute force
technique. 

-- 
Herb Martin

Relevant Pages

  • Re: File Sharing in a Workgroup With Controlled Permissions
    ... Client Computers - XP Pro SP2 ... Simple file sharing has been turned off and NTFS permissions are set up ... A and B full control over folder 2, both folders on the file "server." ...
    (microsoft.public.windowsxp.network_web)
  • Re: Domain permissions
    ... How would I grant the permission to install software without adiministrator ... Click View menu in Active Directory Users and Computers, ... > Control Wizard actually do is to modify the ACL. ... you have to delegate permissions or grant a specific right. ...
    (microsoft.public.windows.server.active_directory)
  • RE: Windows cannot access \Home-pcc - Error Code 0x80070005
    ... Even though I had sharing set up for Everyone (permissions) to read, ... VIOLA...I had computers talking to each other and ... It would be so nice if Microsoft could make the network setup a tad quicker ...
    (microsoft.public.windows.vista.networking_sharing)
  • Re: Configuration problem
    ... Thanks Jerry, that's how I did it under the old system, but for some reason ... So now all computers see each other. ... >>> tried for the umpteenth time to install a home network but to no avail. ... >>> this server to find out if you have access permissions. ...
    (microsoft.public.windowsxp.network_web)
  • File Sharing in a Workgroup With Controlled Permissions
    ... Client Computers - XP Pro SP2 ... Simple file sharing has been turned off and NTFS permissions are set up ... A and B full control over folder 2, both folders on the file "server." ...
    (microsoft.public.windowsxp.network_web)