Solved

how to prevent users from installing applications

Posted on 2008-11-02
11
590 Views
Last Modified: 2012-05-05
Dear Experts,
Can any one kindly tell me how prevent users from installing any applications in there computers. By the way every users is an admin in his own computer.

Windows SBS 2003 / Domain Controller.

Regargds,
Mob
0
Comment
Question by:mob_dream
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
  • 2
  • +2
11 Comments
 
LVL 5

Assisted Solution

by:svelarsen
svelarsen earned 50 total points
ID: 22861165
Admins can do anything on their conputer, so i dont think its possible to prevent installing apps.
Only way is to be a non-admin user and then set permissions.
0
 
LVL 95

Accepted Solution

by:
John Hurst earned 200 total points
ID: 22861242
If you don't want the users to install software, then there really isn't much need from them to be administrators. They can either be standard users (no permissions) or power users (XP concept) with restrictions set in Group Policy. The latter is sometimes necessary for QuickBooks to run and some AntiVirus software to update. .... T
0
 
LVL 7

Assisted Solution

by:pr0t0c0l12
pr0t0c0l12 earned 150 total points
ID: 22861280
By rolling our a group policy is a good idea.  I suggest you download READYSTATE from microsoft, and create a GPO and roll it out to your users.  
Readystate is a program that allows you to lock down the system. Even if users do changes to the system, all you have to do is just restart and it goes back to the previous state.  

This is an alternative to centurion technologies, deepfreeze etc...
0
Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

 
LVL 7

Expert Comment

by:pr0t0c0l12
ID: 22861292
0
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 100 total points
ID: 22861386
You can use a software restriction policy to help http://support.microsoft.com/kb/324036
and
http://www.windowsnetworking.com/articles_tutorials/Software-Restriction-Policies.html
but do they really need to be Local Administrators ? Its asking fro trouble to have them all as local admins.
Its going to be better if you can remove them from the local admins group, even if you could make them power users, that would be better - better still to have them as standard users with no admin rights
0
 

Author Comment

by:mob_dream
ID: 22864863
you know guys why I made them local admins because I don't want to waste my time and get calls every day. Restricted users always kill your mind by asking so many things like (I can't print, I can't share copy what ever).

I am sure you are all right but I think I will make them power users on there computers. I will also check GP
0
 
LVL 95

Expert Comment

by:John Hurst
ID: 22865975
Standard users and Power Users with some restricted install rights can map drives, add network printers, share files and generally work productively.

No, they cannot install software. They also cannot change network settings (which is a bit of a pain). On balance (speaking from experience) restricted machines run better. If you don't have time, then I do understand where you are coming from. .... T
0
 

Author Comment

by:mob_dream
ID: 22874824
Thank you thinkpads_user for your comment. What do you mean by you understand where I'm coming from!!!!
0
 
LVL 70

Expert Comment

by:KCTS
ID: 22874973
Making all users local admins so that you "don't want to waste my time and get calls every day" is not the correct approach - you should always work on the basic of least privilaged use - it may be "easier" to mal all users local admins initially but it leads to exactly the sort of issues you are now experiencing. As local admins they have complete control of their machine, including the ability to remove it from the domain and restricting these rights is frought with problems as, because the are admins, they can undo restrictions that you might impose.
0
 
LVL 95

Expert Comment

by:John Hurst
ID: 22875310
mob_dream - What I meant was that, in the short term, it may be easier to let users do as they wish. In the longer term, what I and other posters here are counselling is that machines will run more reliably over a longer period of time if users are not administrators.
... T
0
 

Author Comment

by:mob_dream
ID: 22920492
Thank you all for your efforts. I changed them to local power users everything went ok except some users when they tried to open there files like access or some folders they get message access denied any way I logged in as administrator and gave them full permmiossions on the files security.

Regards,
0

Featured Post

Announcing the Most Valuable Experts of 2016

MVEs are more concerned with the satisfaction of those they help than with the considerable points they can earn. They are the types of people you feel privileged to call colleagues. Join us in honoring this amazing group of Experts.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
aws pricing 2 85
Server configuration for MS Access - SQL Server app 17 109
Windows 2008 set profile 9 62
Moving database to a shared server 7 34
The articles for turning off the Client firewall policy on the internet are for SBS 2008 and don't really help for SBS 2011. They actually moved the Client firewall policy. In 2011, the client firewall policy has moved to the SBS computers conta…
If you are a user of the discontinued Microsoft Office Accounting 2008 (MSOA) and have to move to a new computer running Windows 8, you will be unhappy to discover that it won't install.  In particular, Microsoft SQL Server 2005 Express Edition (SSE…
Finds all prime numbers in a range requested and places them in a public primes() array. I've demostrated a template size of 30 (2 * 3 * 5) but larger templates can be built such 210  (2 * 3 * 5 * 7) or 2310  (2 * 3 * 5 * 7 * 11). The larger templa…

751 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question