Solved

how to prevent users from installing applications

Posted on 2008-11-02
11
589 Views
Last Modified: 2012-05-05
Dear Experts,
Can any one kindly tell me how prevent users from installing any applications in there computers. By the way every users is an admin in his own computer.

Windows SBS 2003 / Domain Controller.

Regargds,
Mob
0
Comment
Question by:mob_dream
  • 3
  • 3
  • 2
  • +2
11 Comments
 
LVL 5

Assisted Solution

by:svelarsen
svelarsen earned 50 total points
ID: 22861165
Admins can do anything on their conputer, so i dont think its possible to prevent installing apps.
Only way is to be a non-admin user and then set permissions.
0
 
LVL 94

Accepted Solution

by:
John Hurst earned 200 total points
ID: 22861242
If you don't want the users to install software, then there really isn't much need from them to be administrators. They can either be standard users (no permissions) or power users (XP concept) with restrictions set in Group Policy. The latter is sometimes necessary for QuickBooks to run and some AntiVirus software to update. .... T
0
 
LVL 7

Assisted Solution

by:pr0t0c0l12
pr0t0c0l12 earned 150 total points
ID: 22861280
By rolling our a group policy is a good idea.  I suggest you download READYSTATE from microsoft, and create a GPO and roll it out to your users.  
Readystate is a program that allows you to lock down the system. Even if users do changes to the system, all you have to do is just restart and it goes back to the previous state.  

This is an alternative to centurion technologies, deepfreeze etc...
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 7

Expert Comment

by:pr0t0c0l12
ID: 22861292
0
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 100 total points
ID: 22861386
You can use a software restriction policy to help http://support.microsoft.com/kb/324036
and
http://www.windowsnetworking.com/articles_tutorials/Software-Restriction-Policies.html
but do they really need to be Local Administrators ? Its asking fro trouble to have them all as local admins.
Its going to be better if you can remove them from the local admins group, even if you could make them power users, that would be better - better still to have them as standard users with no admin rights
0
 

Author Comment

by:mob_dream
ID: 22864863
you know guys why I made them local admins because I don't want to waste my time and get calls every day. Restricted users always kill your mind by asking so many things like (I can't print, I can't share copy what ever).

I am sure you are all right but I think I will make them power users on there computers. I will also check GP
0
 
LVL 94

Expert Comment

by:John Hurst
ID: 22865975
Standard users and Power Users with some restricted install rights can map drives, add network printers, share files and generally work productively.

No, they cannot install software. They also cannot change network settings (which is a bit of a pain). On balance (speaking from experience) restricted machines run better. If you don't have time, then I do understand where you are coming from. .... T
0
 

Author Comment

by:mob_dream
ID: 22874824
Thank you thinkpads_user for your comment. What do you mean by you understand where I'm coming from!!!!
0
 
LVL 70

Expert Comment

by:KCTS
ID: 22874973
Making all users local admins so that you "don't want to waste my time and get calls every day" is not the correct approach - you should always work on the basic of least privilaged use - it may be "easier" to mal all users local admins initially but it leads to exactly the sort of issues you are now experiencing. As local admins they have complete control of their machine, including the ability to remove it from the domain and restricting these rights is frought with problems as, because the are admins, they can undo restrictions that you might impose.
0
 
LVL 94

Expert Comment

by:John Hurst
ID: 22875310
mob_dream - What I meant was that, in the short term, it may be easier to let users do as they wish. In the longer term, what I and other posters here are counselling is that machines will run more reliably over a longer period of time if users are not administrators.
... T
0
 

Author Comment

by:mob_dream
ID: 22920492
Thank you all for your efforts. I changed them to local power users everything went ok except some users when they tried to open there files like access or some folders they get message access denied any way I logged in as administrator and gave them full permmiossions on the files security.

Regards,
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
What is this Task? 4 132
Generate HTML report about DHCP server 2003 1 45
RAID Configuration 18 62
Excel 2013 Issues 11 46
Because virtualization becomes more and more common, and, with Microsoft Hyper-V included in Windows Server at no additional costs, and, most server hardware nowadays is more than capable of running a physical Small Business Server (SBS) 2008 or 201…
You may have discovered the 'Compatibility View Settings' workaround for making your SBS 2008 Remote Web Workplace 'connect to a computer' section stops 'working around' after a Windows 10 client upgrade.  That can be fixed so it 'works around' agai…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question