Solved

Preventing users from installing software GPO

Posted on 2013-12-12
5
427 Views
Last Modified: 2013-12-20
I need to prevent regular users from install software on there machines.  I know you can create a GPO to turn off windows installer but I need for Admins to beable to install software and I'm afraid if I turn that off no one will be able to install software.  Is there a way I can disable the windows installer but still have it run with admin rights? Basically I'm trying to stop people from updating or installing things like flash, reader, IE11, google chrome, etc.
0
Comment
Question by:WellingtonIS
  • 2
  • 2
5 Comments
 
LVL 35

Expert Comment

by:Mahesh
Comment Utility
You can use GPO software restriction polices with appropriate exceptions

Please check below URL for implementation best practises

http://www.nsa.gov/ia/_files/os/win2k/application_whitelisting_using_srp.pdf

Note that you must set default software restriction policy level to disallowed

Mahesh
0
 

Author Comment

by:WellingtonIS
Comment Utility
THis is ok but it's going to require me to allow anything and everything I want to install - basically I'm trying to accomplish denying the using from installing things and allowing the administrator to install it.
0
 
LVL 1

Expert Comment

by:kostbad
Comment Utility
Disable Windows Installer options:

Never--Windows Installer is fully enabled. Users can install and upgrade software. Windows Installer is enabled by default in Windows.

For non-managed apps only--Users can install only those programs that an administrator assigns (offers on the desktop) or publishes (adds to Add or Remove programs).

Always--Windows Installer is disabled.

-------------------

I think the 2nd option could do your job. Everytime you need to deploy an app, you can publish it thought group policy and it will be available through the add/remove programs menu.
It's much better than sending an admin to every pc to install the software!


Also i might add, that standard users in AD are quite restricted. They can only install certain software with no registry entries.
0
 
LVL 35

Accepted Solution

by:
Mahesh earned 500 total points
Comment Utility
If users are not member of local administrators group and logged on as standard users, by default they cannot install any softwares or device drivers

you can exclude administrators from applying software restrictions policies so that they can install softwares if required.Check below articles

http://technet.microsoft.com/en-us/library/cc776536(v=ws.10).aspx
http://mabdelhamid.wordpress.com/2011/10/23/how-to-configure-applocker-group-policy-to-prevent-software-from-running/

Mahesh
0
 

Author Closing Comment

by:WellingtonIS
Comment Utility
This plus disabling the service for some specific updates is what I did to stop them from installing software.  Thx
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

I hope this helps those who have been battling the SanDisk / U3 problem for a while. For anyone that is running Windows 7 64bit and is receiving and searching the internet for the “Windows Error: Windows has allocated a drive letter to the U3 dri…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now