how to prevent users from installing applications
Dear Experts,
Can any one kindly tell me how prevent users from installing any applications in there computers. By the way every users is an admin in his own computer.
Windows SBS 2003 / Domain Controller.
Regargds,
Mob
Can any one kindly tell me how prevent users from installing any applications in there computers. By the way every users is an admin in his own computer.
Windows SBS 2003 / Domain Controller.
Regargds,
Mob
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
you know guys why I made them local admins because I don't want to waste my time and get calls every day. Restricted users always kill your mind by asking so many things like (I can't print, I can't share copy what ever).
I am sure you are all right but I think I will make them power users on there computers. I will also check GP
I am sure you are all right but I think I will make them power users on there computers. I will also check GP
Standard users and Power Users with some restricted install rights can map drives, add network printers, share files and generally work productively.
No, they cannot install software. They also cannot change network settings (which is a bit of a pain). On balance (speaking from experience) restricted machines run better. If you don't have time, then I do understand where you are coming from. .... T
No, they cannot install software. They also cannot change network settings (which is a bit of a pain). On balance (speaking from experience) restricted machines run better. If you don't have time, then I do understand where you are coming from. .... T
ASKER
Thank you thinkpads_user for your comment. What do you mean by you understand where I'm coming from!!!!
Making all users local admins so that you "don't want to waste my time and get calls every day" is not the correct approach - you should always work on the basic of least privilaged use - it may be "easier" to mal all users local admins initially but it leads to exactly the sort of issues you are now experiencing. As local admins they have complete control of their machine, including the ability to remove it from the domain and restricting these rights is frought with problems as, because the are admins, they can undo restrictions that you might impose.
mob_dream - What I meant was that, in the short term, it may be easier to let users do as they wish. In the longer term, what I and other posters here are counselling is that machines will run more reliably over a longer period of time if users are not administrators.
... T
... T
ASKER
Thank you all for your efforts. I changed them to local power users everything went ok except some users when they tried to open there files like access or some folders they get message access denied any way I logged in as administrator and gave them full permmiossions on the files security.
Regards,
Regards,
http://www.microsoft.com/windows/products/winfamily/sharedaccess/default.mspx