Solved

how to prevent users from installing applications

Posted on 2008-11-02
11
591 Views
Last Modified: 2012-05-05
Dear Experts,
Can any one kindly tell me how prevent users from installing any applications in there computers. By the way every users is an admin in his own computer.

Windows SBS 2003 / Domain Controller.

Regargds,
Mob
0
Comment
Question by:mob_dream
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
  • +2
11 Comments
 
LVL 5

Assisted Solution

by:svelarsen
svelarsen earned 50 total points
ID: 22861165
Admins can do anything on their conputer, so i dont think its possible to prevent installing apps.
Only way is to be a non-admin user and then set permissions.
0
 
LVL 96

Accepted Solution

by:
Experienced Member earned 200 total points
ID: 22861242
If you don't want the users to install software, then there really isn't much need from them to be administrators. They can either be standard users (no permissions) or power users (XP concept) with restrictions set in Group Policy. The latter is sometimes necessary for QuickBooks to run and some AntiVirus software to update. .... T
0
 
LVL 7

Assisted Solution

by:pr0t0c0l12
pr0t0c0l12 earned 150 total points
ID: 22861280
By rolling our a group policy is a good idea.  I suggest you download READYSTATE from microsoft, and create a GPO and roll it out to your users.  
Readystate is a program that allows you to lock down the system. Even if users do changes to the system, all you have to do is just restart and it goes back to the previous state.  

This is an alternative to centurion technologies, deepfreeze etc...
0
Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

 
LVL 7

Expert Comment

by:pr0t0c0l12
ID: 22861292
0
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 100 total points
ID: 22861386
You can use a software restriction policy to help http://support.microsoft.com/kb/324036
and
http://www.windowsnetworking.com/articles_tutorials/Software-Restriction-Policies.html
but do they really need to be Local Administrators ? Its asking fro trouble to have them all as local admins.
Its going to be better if you can remove them from the local admins group, even if you could make them power users, that would be better - better still to have them as standard users with no admin rights
0
 

Author Comment

by:mob_dream
ID: 22864863
you know guys why I made them local admins because I don't want to waste my time and get calls every day. Restricted users always kill your mind by asking so many things like (I can't print, I can't share copy what ever).

I am sure you are all right but I think I will make them power users on there computers. I will also check GP
0
 
LVL 96

Expert Comment

by:Experienced Member
ID: 22865975
Standard users and Power Users with some restricted install rights can map drives, add network printers, share files and generally work productively.

No, they cannot install software. They also cannot change network settings (which is a bit of a pain). On balance (speaking from experience) restricted machines run better. If you don't have time, then I do understand where you are coming from. .... T
0
 

Author Comment

by:mob_dream
ID: 22874824
Thank you thinkpads_user for your comment. What do you mean by you understand where I'm coming from!!!!
0
 
LVL 70

Expert Comment

by:KCTS
ID: 22874973
Making all users local admins so that you "don't want to waste my time and get calls every day" is not the correct approach - you should always work on the basic of least privilaged use - it may be "easier" to mal all users local admins initially but it leads to exactly the sort of issues you are now experiencing. As local admins they have complete control of their machine, including the ability to remove it from the domain and restricting these rights is frought with problems as, because the are admins, they can undo restrictions that you might impose.
0
 
LVL 96

Expert Comment

by:Experienced Member
ID: 22875310
mob_dream - What I meant was that, in the short term, it may be easier to let users do as they wish. In the longer term, what I and other posters here are counselling is that machines will run more reliably over a longer period of time if users are not administrators.
... T
0
 

Author Comment

by:mob_dream
ID: 22920492
Thank you all for your efforts. I changed them to local power users everything went ok except some users when they tried to open there files like access or some folders they get message access denied any way I logged in as administrator and gave them full permmiossions on the files security.

Regards,
0

Featured Post

Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Small Business Server 2011. NOTE: This guide has been written using the preview version of SBS2011 therefore some of the screens may …
Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
There's a multitude of different network monitoring solutions out there, and you're probably wondering what makes NetCrunch so special. It's completely agentless, but does let you create an agent, if you desire. It offers powerful scalability …
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

627 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question