how to Restrict Software installation on Windows Server 2003 terminal server user

jjoz
jjoz used Ask the Experts™
on
Hi,

Does anyone know how to Restrict Software installation on Windows Server 2003 terminal server user ?

I've got a WindowsServer 2003 already setup but all of the user still have full access on it ?

Thanks.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
On the 2003 server.  Under All Programs, select Administrative tools, then Terminal Services Configuration, in the connections area find your connection, then right click the connection and select the Permissions tab you can setup the user/group security for the Terminal server connections there.

Author

Commented:
oh i'm now confused in the local GPO using  gpedit.msc

USER Configuration\Administrative Templates\Windows Components\Windows Installer
USER Configuration\Administrative Templates\Control Panel\Add/Remove Programs

but I'll try your suggestion anyway.

Thanks for reply
GPO is good for overall server connections especially on a Domain Controller. But if you are refferring to strictly Terminal Server connections you can set the user/group setting for Terminal server security using my last post.
Success in ‘20 With a Profitable Pricing Strategy

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
Hi Patmac951,

here it is the properties page on my terminal server named VOLGREN,

should I put DOMAIN\Allusersgroup(Custom made Security group) there as well ?

RDP.jpg
Commented:
Use Regedit to navigate to:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software
Use Security / Permissions to remove the write permission on this key for ordinary users.  
Below reference is one of the best link for Terminal server issues.
References
http://www.msterminalservices.org/faq/WindowsTerminalServices/?page=22 
 
 
This depends upon your environment and the local users/groups. Is the Terminal Server you are referring to also a Domain Controller?  

If you are trying to restrict software from being installed by terminal server users...just make sure the group/user only has User Access and Guest Access and not full control

Author

Commented:
"just make sure the group/user only has User Access and Guest Access and  not full control" --> how can I do that ?

sorry to keep asking Pat.
Make sure the Remote Desktop users only have guest and or user access checked.  Also the above post from Awinish brought up a good point...you can restrict this access in the registry.  At a command prompt run REGEDIT and navigate to the entry Awinish mentioned above and modify the value in the registry.

Author

Commented:
Thanks for the suggestions sir !

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial