Solved

how to prevent users from installing applications

Posted on 2008-11-02
11
588 Views
Last Modified: 2012-05-05
Dear Experts,
Can any one kindly tell me how prevent users from installing any applications in there computers. By the way every users is an admin in his own computer.

Windows SBS 2003 / Domain Controller.

Regargds,
Mob
0
Comment
Question by:mob_dream
  • 3
  • 3
  • 2
  • +2
11 Comments
 
LVL 5

Assisted Solution

by:svelarsen
svelarsen earned 50 total points
ID: 22861165
Admins can do anything on their conputer, so i dont think its possible to prevent installing apps.
Only way is to be a non-admin user and then set permissions.
0
 
LVL 93

Accepted Solution

by:
John Hurst earned 200 total points
ID: 22861242
If you don't want the users to install software, then there really isn't much need from them to be administrators. They can either be standard users (no permissions) or power users (XP concept) with restrictions set in Group Policy. The latter is sometimes necessary for QuickBooks to run and some AntiVirus software to update. .... T
0
 
LVL 7

Assisted Solution

by:pr0t0c0l12
pr0t0c0l12 earned 150 total points
ID: 22861280
By rolling our a group policy is a good idea.  I suggest you download READYSTATE from microsoft, and create a GPO and roll it out to your users.  
Readystate is a program that allows you to lock down the system. Even if users do changes to the system, all you have to do is just restart and it goes back to the previous state.  

This is an alternative to centurion technologies, deepfreeze etc...
0
U.S. Department of Agriculture and Acronis Access

With the new era of mobile computing, smartphones and tablets, wireless communications and cloud services, the USDA sought to take advantage of a mobilized workforce and the blurring lines between personal and corporate computing resources.

 
LVL 7

Expert Comment

by:pr0t0c0l12
ID: 22861292
0
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 100 total points
ID: 22861386
You can use a software restriction policy to help http://support.microsoft.com/kb/324036
and
http://www.windowsnetworking.com/articles_tutorials/Software-Restriction-Policies.html
but do they really need to be Local Administrators ? Its asking fro trouble to have them all as local admins.
Its going to be better if you can remove them from the local admins group, even if you could make them power users, that would be better - better still to have them as standard users with no admin rights
0
 

Author Comment

by:mob_dream
ID: 22864863
you know guys why I made them local admins because I don't want to waste my time and get calls every day. Restricted users always kill your mind by asking so many things like (I can't print, I can't share copy what ever).

I am sure you are all right but I think I will make them power users on there computers. I will also check GP
0
 
LVL 93

Expert Comment

by:John Hurst
ID: 22865975
Standard users and Power Users with some restricted install rights can map drives, add network printers, share files and generally work productively.

No, they cannot install software. They also cannot change network settings (which is a bit of a pain). On balance (speaking from experience) restricted machines run better. If you don't have time, then I do understand where you are coming from. .... T
0
 

Author Comment

by:mob_dream
ID: 22874824
Thank you thinkpads_user for your comment. What do you mean by you understand where I'm coming from!!!!
0
 
LVL 70

Expert Comment

by:KCTS
ID: 22874973
Making all users local admins so that you "don't want to waste my time and get calls every day" is not the correct approach - you should always work on the basic of least privilaged use - it may be "easier" to mal all users local admins initially but it leads to exactly the sort of issues you are now experiencing. As local admins they have complete control of their machine, including the ability to remove it from the domain and restricting these rights is frought with problems as, because the are admins, they can undo restrictions that you might impose.
0
 
LVL 93

Expert Comment

by:John Hurst
ID: 22875310
mob_dream - What I meant was that, in the short term, it may be easier to let users do as they wish. In the longer term, what I and other posters here are counselling is that machines will run more reliably over a longer period of time if users are not administrators.
... T
0
 

Author Comment

by:mob_dream
ID: 22920492
Thank you all for your efforts. I changed them to local power users everything went ok except some users when they tried to open there files like access or some folders they get message access denied any way I logged in as administrator and gave them full permmiossions on the files security.

Regards,
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you are a user of the discontinued Microsoft Office Accounting 2008 (MSOA) and have to move to a new computer running Windows 8, you will be unhappy to discover that it won't install.  In particular, Microsoft SQL Server 2005 Express Edition (SSE…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question