Re: Deny install software by Helpdeskadmin@server.local

Matt,
It sounds like they are using that account to push out the software. That
account probably has admin rights on the server, which is how it can install
it. It must have admin rights either directly, or as a member of a group.
If it is direct, you can remove it. If it is put there by a Restricted
Groups policy, you can't. If it is a member of a group, you can only remove
it from the group.
You could try the Local Security Policy, User Rights Assignment, and try the
Denies, but it is a bit of a hackaround. You could also put a Deny on the
whole file system and registry for that account so the whole installation
will fail.
Anthony,
http://www.airdesk.co.uk





"Matt Carter" <MLCarter1976@xxxxxxxxxx(doNOTspam)> wrote in message
news:FCA3347F-DD7F-41D7-8009-DE60D329FEC5@xxxxxxxxxxxxxxxx
The software is trying to install on systems and they do not support
trying
to prevent it from going to systems, so I want to set it up to have AD do
that. I do not need to install any software such as by using a GPO. The
software is already installed and working. I want to STOP someone from
logging on, installing, using the servers. I created a user account that
I
want to use that will do that. I need to know how to do that and that way
I
can say OK when YOU try to log on, YOU can NOT do anything, don't even TRY
To
get onto this server. That's what I want.

"Jorge Silva" wrote:

Hi
If your software is smart enough to discover and install, then it should
be
smart enough to include exclusion list giving you the ability to exclude
the
computers that you want.

If you want to use GPO to deply the software and you only want to apply
it
to the Computers, then you should link the GPO only to the computers OU,
or
use WMI filter to filter out the DCs.

--
I hope that the information above helps you.
Have a Nice day.

Jorge Silva
MCSE, MVP Directory Services
"Matt Carter" <MLCarter1976@xxxxxxxxxx(doNOTspam)> wrote in message
news:60B0D1F5-3660-4A69-AE2E-B273B6016EE9@xxxxxxxxxxxxxxxx
Steve B., the helpdesk software goes out I believe IP address by IP
address
and looks for the ability to update the system.

"Steve B" wrote:

Just to clarify - are you saying that when the helpdeskadministrator
logs
onto any machine some software is installed? You don't want this to
happen
on servers?

"Matt Carter" wrote:

We have a helpdesk software that likes to install itself on all the
systems
in the company. For the servers, we do NOT want this. I spoke with
tech
support and they said to create a user, as I have, that has domain
permissions to install on the local user systems, and to great a GPO
in
AD on
Server 2003 that has HelpdeskAdministrator@xxxxxxxxxx account and
then
set
that account to DENIED to the member servers and the domain
controllers.
I am not sure where in the GPO to go to edit and do I make it
enabled,
etc.

Basically:
I want to have Group Policy see that the user helpdeskadministrator
is
trying to install and to have the group policy DENY that
installation
of the
software.

Thank you for your help.





.

Relevant Pages

  • RE: XP Policy Questions..
    ... users cannot install most of the programs. ... Group Policy then there is a chance that they can access ... > computers and 2 servers. ... > and the second is running Windows 2000 Server. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Manage User Privileges Programmatically
    ... group which grants the necessary privileges (no, the name of the group is ... accounts that still survive group policy lockdown... ... As a dev I understand the need to make sure that an account has ... result in a non-working install as soon as group policy applied from ...
    (microsoft.public.win2000.security)
  • Re: User in two groups Admin and Power User
    ... it looks like the Group Policy doesn't allow the local ... Power Users / Administrators to install that particular software. ... | In this case, the user account was a domain account, and I believe my ... |> on to the local machine, as a local administrator can install ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Rare ADAM instance setup problem
    ... It seems that you have a case where the account ... If you run the ADAM setup wizard manually on such a problem machine ... install it creates an ADAM instance and sets up additional schema etc. ... On most servers it works fine but I ...
    (microsoft.public.windows.server.active_directory)
  • Re: Manage User Privileges Programmatically
    ... the default behavior of IIS 6 (and for that matter ComAdmin ... under default account naming, IIRC) is a pain - well, at least it forces ... > accounts that still survive group policy lockdown... ... > result in a non-working install as soon as group policy applied from ...
    (microsoft.public.win2000.security)