We help IT Professionals succeed at work.

setup windows 2003 group policy object editor to prevent users from installing programs on there pc.

snipa911
snipa911 asked
on
Medium Priority
2,865 Views
Last Modified: 2008-01-23
Hi,
    My question is this, I am setting up a Windows 2003 server box and I have created an organization Unit and am setting a group policy for this unit so that the users i place in the OU group will be restricted from messing around on there xp workstation.  So I would like to prevent users from downloading and installing programs.  Does anyone know where in group policy editor it needs to be modified so that users can not download and install programs.

Thanks

Mike
Comment
Watch Question

Commented:
The best thing you can do is not to give users Local Power Users or Administrator permissions.
Don't add the Domain User account to the local Power Users or Administrators group.

Here an article from Microsoft Technet Magazine.
http://www.microsoft.com/technet/technetmag/issues/2005/11/FieldNotes/?related=y

Cheers,
NITADMIN

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
Under the computer configuration for your group policy, you can change the quota limit to disallow people from saving files to the hard drive, which would include installation as well. If they were still standard users, they would still have rights to save files on the pc, so the gpo is needed...

Commented:
hi, there

If you bought a SBS premium edition there is the included ISA 2004 firewall.

http://www.microsoft.com/technet/isa/2004/plan/httpfiltering.mspx

Cooledit
(((((((((((( ONE )))))))))))
Download the Microsoft Group Management Console. It will allow you to view all policies and policy results in a much better and more consistant format. Hopefully this will help.

http://www.microsoft.com/windowsserver2003/gpmc/default.mspx
---------------------------------------------------------------------------------------
((((((((((( TWO )))))))))))))))
What other options are you seeing that are different?  When you open the Group Policy Editor on a domain object the options should be the same.  There would be a slight difference with local policies and domain policies.
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.