Prevent local administrator from installing software

I'm running a Windows 2003 server with all 2000/XP workstations.
Many of the software applications we use require the user to be a local admin.
Is there any way I can prevent users from installing applications or software by using Group Policy or remove them from local administrator but kipping all of their software running without needs of local administrator permissions.
Thanks
AlkannetworksAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Brian PiercePhotographerCommented:
In a word no - if you don't want users to install software, don't make them local administrators. Properly written applications should not require users to be admins.
0
johnb6767Commented:
Well said... Even the poorly written apps can be made to function as a limited user, by identifying the areas where the users need access to, using the following tools....

RegMon for Windows v7.04
http://www.microsoft.com/technet/sysinternals/utilities/regmon.mspx

FileMon for Windows v7.04
http://www.microsoft.com/technet/sysinternals/FileAndDisk/Filemon.mspx

Set the filter at the top to highlight "access denied", and and try and recreate the errors....Then go to these and look for the red, and it will tell you where the permissions are shot....

Or even use the new and improved utility form Sysinternals, that contains them both....

Process Monitor v1.22
http://www.microsoft.com/technet/sysinternals/utilities/processmonitor.mspx
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Brian PiercePhotographerCommented:
Another alternative is to apply the compatws template which relaxes some of the user restrictions (at the expense of security it has to be said).

See http://technet2.microsoft.com/windowsserver/en/library/e4026462-791d-43ff-adb1-ae074feb37ea1033.mspx?mfr=true
for details - the links at the bottom of this page deal with how to apply it.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.