Solved

Preventing users from installing software GPO

Posted on 2013-12-12
5
441 Views
Last Modified: 2013-12-20
I need to prevent regular users from install software on there machines.  I know you can create a GPO to turn off windows installer but I need for Admins to beable to install software and I'm afraid if I turn that off no one will be able to install software.  Is there a way I can disable the windows installer but still have it run with admin rights? Basically I'm trying to stop people from updating or installing things like flash, reader, IE11, google chrome, etc.
0
Comment
Question by:WellingtonIS
  • 2
  • 2
5 Comments
 
LVL 36

Expert Comment

by:Mahesh
ID: 39714084
You can use GPO software restriction polices with appropriate exceptions

Please check below URL for implementation best practises

http://www.nsa.gov/ia/_files/os/win2k/application_whitelisting_using_srp.pdf

Note that you must set default software restriction policy level to disallowed

Mahesh
0
 

Author Comment

by:WellingtonIS
ID: 39714120
THis is ok but it's going to require me to allow anything and everything I want to install - basically I'm trying to accomplish denying the using from installing things and allowing the administrator to install it.
0
 
LVL 1

Expert Comment

by:kostbad
ID: 39715358
Disable Windows Installer options:

Never--Windows Installer is fully enabled. Users can install and upgrade software. Windows Installer is enabled by default in Windows.

For non-managed apps only--Users can install only those programs that an administrator assigns (offers on the desktop) or publishes (adds to Add or Remove programs).

Always--Windows Installer is disabled.

-------------------

I think the 2nd option could do your job. Everytime you need to deploy an app, you can publish it thought group policy and it will be available through the add/remove programs menu.
It's much better than sending an admin to every pc to install the software!


Also i might add, that standard users in AD are quite restricted. They can only install certain software with no registry entries.
0
 
LVL 36

Accepted Solution

by:
Mahesh earned 500 total points
ID: 39715889
If users are not member of local administrators group and logged on as standard users, by default they cannot install any softwares or device drivers

you can exclude administrators from applying software restrictions policies so that they can install softwares if required.Check below articles

http://technet.microsoft.com/en-us/library/cc776536(v=ws.10).aspx
http://mabdelhamid.wordpress.com/2011/10/23/how-to-configure-applocker-group-policy-to-prevent-software-from-running/

Mahesh
0
 

Author Closing Comment

by:WellingtonIS
ID: 39731714
This plus disabling the service for some specific updates is what I did to stop them from installing software.  Thx
0

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Learn about cloud computing and its benefits for small business owners.
When you try to extract and to view the contents of a Microsoft Update Standalone Package (MSU) for Windows Vista, you cannot extract the files from the MSU. Here we are going to explain how to extract those hotfix details without using any third pa…
This Micro Tutorial will give you basic overview of the control panel section on Windows 7. It will depth in Network and Internet, Hardware and Sound, etc. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial will give you a introduction in two parts how to utilize Windows Live Movie Maker to its maximum capability. This will be demonstrated using Windows Live Movie Maker on Windows 7 operating system.

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question