Solved

how to prevent users from installing applications

Posted on 2008-11-02
11
587 Views
Last Modified: 2012-05-05
Dear Experts,
Can any one kindly tell me how prevent users from installing any applications in there computers. By the way every users is an admin in his own computer.

Windows SBS 2003 / Domain Controller.

Regargds,
Mob
0
Comment
Question by:mob_dream
  • 3
  • 3
  • 2
  • +2
11 Comments
 
LVL 5

Assisted Solution

by:svelarsen
svelarsen earned 50 total points
ID: 22861165
Admins can do anything on their conputer, so i dont think its possible to prevent installing apps.
Only way is to be a non-admin user and then set permissions.
0
 
LVL 92

Accepted Solution

by:
John Hurst earned 200 total points
ID: 22861242
If you don't want the users to install software, then there really isn't much need from them to be administrators. They can either be standard users (no permissions) or power users (XP concept) with restrictions set in Group Policy. The latter is sometimes necessary for QuickBooks to run and some AntiVirus software to update. .... T
0
 
LVL 7

Assisted Solution

by:pr0t0c0l12
pr0t0c0l12 earned 150 total points
ID: 22861280
By rolling our a group policy is a good idea.  I suggest you download READYSTATE from microsoft, and create a GPO and roll it out to your users.  
Readystate is a program that allows you to lock down the system. Even if users do changes to the system, all you have to do is just restart and it goes back to the previous state.  

This is an alternative to centurion technologies, deepfreeze etc...
0
 
LVL 7

Expert Comment

by:pr0t0c0l12
ID: 22861292
0
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 100 total points
ID: 22861386
You can use a software restriction policy to help http://support.microsoft.com/kb/324036
and
http://www.windowsnetworking.com/articles_tutorials/Software-Restriction-Policies.html
but do they really need to be Local Administrators ? Its asking fro trouble to have them all as local admins.
Its going to be better if you can remove them from the local admins group, even if you could make them power users, that would be better - better still to have them as standard users with no admin rights
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 

Author Comment

by:mob_dream
ID: 22864863
you know guys why I made them local admins because I don't want to waste my time and get calls every day. Restricted users always kill your mind by asking so many things like (I can't print, I can't share copy what ever).

I am sure you are all right but I think I will make them power users on there computers. I will also check GP
0
 
LVL 92

Expert Comment

by:John Hurst
ID: 22865975
Standard users and Power Users with some restricted install rights can map drives, add network printers, share files and generally work productively.

No, they cannot install software. They also cannot change network settings (which is a bit of a pain). On balance (speaking from experience) restricted machines run better. If you don't have time, then I do understand where you are coming from. .... T
0
 

Author Comment

by:mob_dream
ID: 22874824
Thank you thinkpads_user for your comment. What do you mean by you understand where I'm coming from!!!!
0
 
LVL 70

Expert Comment

by:KCTS
ID: 22874973
Making all users local admins so that you "don't want to waste my time and get calls every day" is not the correct approach - you should always work on the basic of least privilaged use - it may be "easier" to mal all users local admins initially but it leads to exactly the sort of issues you are now experiencing. As local admins they have complete control of their machine, including the ability to remove it from the domain and restricting these rights is frought with problems as, because the are admins, they can undo restrictions that you might impose.
0
 
LVL 92

Expert Comment

by:John Hurst
ID: 22875310
mob_dream - What I meant was that, in the short term, it may be easier to let users do as they wish. In the longer term, what I and other posters here are counselling is that machines will run more reliably over a longer period of time if users are not administrators.
... T
0
 

Author Comment

by:mob_dream
ID: 22920492
Thank you all for your efforts. I changed them to local power users everything went ok except some users when they tried to open there files like access or some folders they get message access denied any way I logged in as administrator and gave them full permmiossions on the files security.

Regards,
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Introduction At 19:33 (UST) on Tuesday 21st September the long awaited email arrived with the subject title of “ANNOUNCING THE AVAILABILITY OF WINDOWS SBS 7 PREVIEW”.  It was time to drop whatever I was doing and dedicate as much bandwidth as possi…
The articles for turning off the Client firewall policy on the internet are for SBS 2008 and don't really help for SBS 2011. They actually moved the Client firewall policy. In 2011, the client firewall policy has moved to the SBS computers conta…
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

23 Experts available now in Live!

Get 1:1 Help Now