Security

Ask something
Discussion Locked

Restrict User Installs w/Policy

0 helpful
6 replies

by castro.c

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have various users on the network (Win2000 Servers and WinXPPro desktops) and I want to restrict a specific domain group (students) so they cannot install anything on the desktop no matter what their local policy status (restricted user or power user) except administrators.

There will be various users (faculty, staff, employees) on the desktops besides the "students" so I need to apply this only to that group.

I don't want to have to specify the applications they can or cannot use...too lengthy and too many different computers labs with different software setups.

I just want something that states this particular group cannot install anything...period. Does this exist?

6 replies

by thamer

View the Support WebCast on this MS KBase Article - 811782, "Webcast: Microsoft Windows XP: An Overview of Policies and Profiles"
http://support.microsoft.com/default.aspx?scid=kb;en-us;811782

... as it will help you to understand how to manage user profiles in Windows XP. Topics will include local, roaming, and mandatory profiles and using Group Policy to control user capabilities and rights.

And...
MS KB Article - 325222: WebCast: Administration and Implementation of Group Policy in Windows 2000
http://support.microsoft.com/default.aspx?scid=kb;en-us;325222

(Eliminate the spaces from the URL name when you cut and paste it in your addreessbar.)

I hope this helps.

by whw

Easy enough create a mandatory profile and give them read-only access to it. Then, just make sure your local hard drives have a simularly restrictive set of permissions. This could easily be automated via your logon script.

Additioall, you could use regedit32 to lock out write access to specific registry keys, thus preventing installs. Export the settings and integrate them into your logon script.

But to risk repeat myself, setting up a good set of disk permissions is probably the simplest and most effective option. If you can't write, you can't install :)

HIH

by ewgny

Answer 2 is correct. Your students should only have "user" status and therefore cannot install programs. (Actually none of your users should have anything more than user status). By giving the students Mandatory roaming profiles, anything that they would leave on the desktop would be gone the next time they logon. Regular user would not be affected by this. You should look at a product called deepfreeze www.deepfreezeusa.com for use on Workstations that your students use.

This discussion is closed to new replies.