Questions

How to prevent users from installing programs

Tags:
+
0 Votes
Locked

How to prevent users from installing programs

jarmburg
My problem is that in order for one of our softwares to work, the users must be a member of the local admin group on their pc's. Is there any way to prevent them from downloading programs (itunes, aol im, games, etc.)?
MS SBS 2003 domain, Win XP workstations, no proxy or site blocking rules.
  • +
    0 Votes
    Darryl~ Moderator

    Can't you just grant them permissions to the files/folders required for your software to work?

    Where I'm employed, the regular users don't have any Admin rights....we just determine which files they require write, delete, etc. permissions to make their software function properly & grant it to them at that level.....we would never make them a member of the Administrators group....for my everyday/normal computer usage at work I don't even log in with an "Administrator" account myself.

    +
    0 Votes
    AnsuGisalas

    Whitelisting.

    Or, barring that, you could try to make them "second-class" admins by removing certain rights from these "administrators" with the computer management utility.
    You'd have to go with trial and error to see which rights that app requires, and which ones it doesn't, then cut out all the above-user rights that aren't required.

    The Computer management util can do this, but I haven't done something like that myself, so I'm not sure how well it works, or if it has weaknesses to be exploited.

    I do think it's a highly messed up situation.

    +
    0 Votes
    Tony Hopkinson

    the fault than address the symptom.

    Downloading is irrelevant, they could do that at home and put it on a stick...

    No proxy, no site blocking and they are local admins and you are concerned about what they deliberately install?

  • +
    0 Votes
    Darryl~ Moderator

    Can't you just grant them permissions to the files/folders required for your software to work?

    Where I'm employed, the regular users don't have any Admin rights....we just determine which files they require write, delete, etc. permissions to make their software function properly & grant it to them at that level.....we would never make them a member of the Administrators group....for my everyday/normal computer usage at work I don't even log in with an "Administrator" account myself.

    +
    0 Votes
    AnsuGisalas

    Whitelisting.

    Or, barring that, you could try to make them "second-class" admins by removing certain rights from these "administrators" with the computer management utility.
    You'd have to go with trial and error to see which rights that app requires, and which ones it doesn't, then cut out all the above-user rights that aren't required.

    The Computer management util can do this, but I haven't done something like that myself, so I'm not sure how well it works, or if it has weaknesses to be exploited.

    I do think it's a highly messed up situation.

    +
    0 Votes
    Tony Hopkinson

    the fault than address the symptom.

    Downloading is irrelevant, they could do that at home and put it on a stick...

    No proxy, no site blocking and they are local admins and you are concerned about what they deliberately install?