Just wanted to say this is my first post on experts exchange!
What im wondering is how to lock down users when it comes to installing things from the internet.. Example the google bar, Screen Savers, Date managers, Clocks, New Themes, etc...
Let me give you a senario: We had a user recently download and install some new screen saver program off the internet. Her account has power user status on that machine. Our policy here is do not install anything that does not pertain to your job. More of a written policy then a computer policy. But I'm sure all of you are aware this is taken very litely when it comes to the end user. So this user downloaded the screen saver program and installed it on her machine. Well little did she know it also installed about 3 other programs. One of these in particular was called Super Bar, which is from what I can tell a search attachment to IE's Menu Bar. Thanks to this program any PDF she would open in IE would crash IE as soon as you closed it.
How can we prevent this? She needs to be a power user do to a few programs she has to use for work. Though im not really sure making her a regular user would even stop this.
Are there any specific policies that can be turned on to prevent users from installing things off the internet?!
We are running Windows 2000 AD as our domain structure.
Thanks guys/gals for your help!!!
Matt
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
HOW TO: Open the Group Policy snap-in:
1. Start / Run
2. Input GPEDIT.MSC
3. Press Enter
4. Choose Local Computer Policy
5. Choose Administrative Templates
6. Choose Windows Components
7. Choose Internet Explorer
4-7. Same with User Configuration
4. Choose User Configuration
5. Choose Windows Settings
6. Choose Internet Explorer Maintenance
I forgot to tell you how to use Secedit.exe to Force Group Policy (GPO) to Be Applied Again:
Refresh policy from the server:
1. Start / Run
2. CMD
3. SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE
4. SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE
5. EXIT
If you don't want to se the result, you can use:
1. Start / Run
2. SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE
3. Start / Run
4. SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE
:o) MAV7469 yes - or an umbrella
Honestly, stopping the User from installing "anything" is almost impossible.
Things like "Active X" and "Java Apps" are going to be difficult to stop.
Heck, even "WebShots" can still be installed with just plain User rights. (Man do I hate WebShots.... :P)
Poorly written programs may not even check to ensure that the installer has rights to the proper Folders and Registry Keys before installing. They may simply install without any error checking, thereby causing problems.
We are looking into this as well and right now, I am leaning towards something I saw in Windows XP. This policy would only allow applications to be installed that have a GUID that matches a list specified by IS.
I would suggest strict enforcement of the policies as the best defense right now.
Either that or give some thought to a "Thin Client". No Hard Drives... PXE Boot only... :)
I am interested to see what the other Experts say about this topic.
Anyhow, that is my two cents worth so far...
Mirfster
Among others on Computer Configuration\Administrati
Disable Automatic Install of Internet Explorer components
http://msdn.microsoft.com/
I agree with Mirfster, it is impossible to prevent user to install downloaded program from internet except your company really want to implement the zero tolerent computer policy. Group policies is a good passive technical way. Windows XP has better security control, you can only allow what application can be run in the system. Of cause, you can configure IE to restrict Download; however, this setting to restrict all the download from IE. If you company has budget, you may consider bring in some extra software to protect the system. For say, a product called Deep Freeze, see URL listed http://www.deepfreezeusa.c
Has anyone mentioned the possibility of using "Madatory Profiles"?. This may help, in the fact that they cannot modify the Profile, so IE settings will not hold the next time they log on. But it may not solve the problem of "orphaned" files from the Users trying to install poorly written programs.
If "mandatory Profiles" have been mentioned then, I apologize and agree with that persons suggestion.
Mirfster.
Try 1st security agent software www.softheap.com , with this u can able to restrict lots of things in ur network , b o luck.
You could block access to all shareware sites (www.download.com etc.) using DNS Redirector from www.jpelectron.com/dnsredi
This would also let you block porn, online games, and other crap you probably don't want to deal with.
JP_ELECTRON ... "using DNS Redirector from ...www.JPELECTRON.com"
According to Expert-Exchange Member Agreement - 3. Guidelines for Use - It's not allowed to advertice
https://secure.experts-exc
It looks like you did that. If so, please ask a 0 point question to a moderator in http://beta.experts-exchan
techshock:
This old question needs to be finalized -- accept an answer, split points, or get a refund. For information on your options, please click here-> http:/help/closing.jsp#1
EXPERTS:
Post your closing recommendations! No comment means you don't care.
Business Accounts
Answer for Membership
by: trywaredkPosted on 2003-05-22 at 09:04:46ID: 8565562
I'm not specific answering your question, but here's some reading about your issue:
How do I use Group Policy to implement Internet Explorer Advanced Settings?
http://www.jsiinc.com/subm
Internet Explorer Group Policy security settings need some extra help?
http://www.jsiinc.com/subj
Domain Security Policy in Windows 2000
http://support.microsoft.c
Troubleshooting Group Policy Application Problems
http://support.microsoft.c
http://www.microsoft.com/w
Does windows2000 has security monitoring to know if somebody's overriding my group policy (GPO):
http://www.experts-exchang
Local Group Policy Settings Do Not Take Effect
http://support.microsoft.c
Using Secedit.exe to Force Group Policy (GPO) to Be Applied Again:
http://support.microsoft.c
Many Regards
Jorgen Malmgren
IT-Supervisor
Denmark
:o) Your brain is like a parachute. It works best when it's open