how to Restrict Software installation on Windows Server 2003 terminal server user

jjoz used Ask the Experts™

Does anyone know how to Restrict Software installation on Windows Server 2003 terminal server user ?

I've got a WindowsServer 2003 already setup but all of the user still have full access on it ?

Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
On the 2003 server.  Under All Programs, select Administrative tools, then Terminal Services Configuration, in the connections area find your connection, then right click the connection and select the Permissions tab you can setup the user/group security for the Terminal server connections there.


oh i'm now confused in the local GPO using  gpedit.msc

USER Configuration\Administrative Templates\Windows Components\Windows Installer
USER Configuration\Administrative Templates\Control Panel\Add/Remove Programs

but I'll try your suggestion anyway.

Thanks for reply
GPO is good for overall server connections especially on a Domain Controller. But if you are refferring to strictly Terminal Server connections you can set the user/group setting for Terminal server security using my last post.
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!


Hi Patmac951,

here it is the properties page on my terminal server named VOLGREN,

should I put DOMAIN\Allusersgroup(Custom made Security group) there as well ?

Use Regedit to navigate to:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software
Use Security / Permissions to remove the write permission on this key for ordinary users.  
Below reference is one of the best link for Terminal server issues.
This depends upon your environment and the local users/groups. Is the Terminal Server you are referring to also a Domain Controller?  

If you are trying to restrict software from being installed by terminal server users...just make sure the group/user only has User Access and Guest Access and not full control


"just make sure the group/user only has User Access and Guest Access and  not full control" --> how can I do that ?

sorry to keep asking Pat.
Make sure the Remote Desktop users only have guest and or user access checked.  Also the above post from Awinish brought up a good can restrict this access in the registry.  At a command prompt run REGEDIT and navigate to the entry Awinish mentioned above and modify the value in the registry.


Thanks for the suggestions sir !

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial