Blocking users from installing

Look into system policies. With VERY strong system policies, you can lock the machine down totally. You can limit the executables that the users can run, you can take the "RUN" option off the Start Menu, remove the "File, Run" menu option, remove the ability to run a command prompt - all kinds of stuff.

You need to look at the options and consider a strategy that will lock the system down inthe way you desire but will still allow the users to do their work.

Look into it in the NT documentation. I am sure that you will find that it does the job...

Dale Holmes
CCNA, MCSE, CNE, UNIX/C
passed CCIE written... lab in April!
Senior Technical Consultant, AllNet, LLC

Think alot about this strategy before you implement it!! You can do all those things mentioned in the previous answer, but sometimes these cause more problems with obstreperous users than giving them limited installation capabilities. One of the things to consider is that, particularly with downloaded self-running .exe files (like those used by many companies like AOL and even Microsoft in some cases for program updates), there is nothing you can do to prevent them from running unless you prevent the user from downloading them. They will run but, depending upon the program's error correction capabilities, will either give lots of error messages, or will run but still won't work afterward, because the user doesn't have permission to add registry settings, etc. This can sometimes cause more headaches in the long run. A strong company policy on this subject helps - although there are always those users who just don't follow the rules! Good Luck...

Using a policy is always a great idea as you can do so much with them.
A policy will not always stop installs of small apps though, the only way to do this is to secure the workstation. Secure the directory structures using the cacls command. I have an example on my web site in the Batch files section. Http://www.bovistech.co.uk

Just a few more thoughts to my earlier msg:

I have to agree with the earlier correspondent, if you apply a strict Policy on the local machine, chances are you will end up with more work on your plate than before.

Restricting what users can run(using the policy) is not fulproof at all, in fact - most people inclined to download programs, will find a way around these restrictions.

Another possibility, would be to look into File permissions on the local drive. Users need only have READ access to most of the local machine (obvious exceptions to this rule which I won't go into here).

This would stop them installing the applications because they don't have the necessary write permissions. Where they are able to install (ie %TEMP% etc) you could ensure you delete everything from %TEMP% every boot, hence removing the application. The only drawback is you piss the user off, which sometimes can be a very bad thing :-)

Cat and mouse really. A combination of file and registry security should do

You can restrict applications that users can run by editting the registry:

Key name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Create a new DWORD value and name it 'RestrictRun' set the value to equal '1' for enabled or '0' for disabled.

Then define the applications the are allowed to be run at:

Key name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun

Creating a new string value for each application, named as consecutive numbers.

Reboot the computer for the changes to take affect.

For example:

Entry name: 1
Entry value: "notepad.exe"

Good luck,

Duong beo

This question was auto closed due to inactivity