Windows Forum

Ask something
Discussion Locked

Block users from installing software

0 helpful
12 replies

by timgray

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Under windows 2000 in a domain network where I have no access to the PDC. How can I without buying additional software, block the regular user from installing software but allow regular use of the computer? (generating data files, local database app allowed to generate files, etc...)
changing the user profile is not an option - I have over 12000 user profiles in the domain user database, I have control over 100 machines and users so whatever solution has to be machine specific and could care less about who the user is.

12 replies

by campbell

If you are using windows 2k pro on the workstations then you can remove them from the LOCAL admin account also do not make them power users. This will restict them from installing programs. but they will be able to run everything

by timgray

I just tried that, they are only members of the domain users group. (default when a user from the domain logs in for the very first time on that pc) I then selected a program from CD clicked on setup.exe and voila the program installed happily. the users are not specified in any local groups.

by soekratis

Here's a suggestion. In Windows 2000, you can restrict users from accessing the Floppy Disk Drive and CD-ROM Drive, thus preventing them from installaing any software. This is done by defining it in the Administrator Tools-Local Security Policy and under the folder Local Policies-Security Options. Hope this will help.

Regards
Soekratis

by timgray

This works great for CDRom (of which I confiscated and locked in a safe in my office) and floppy. but 99% of all installs happen from internet downloads, email,etc... NT's domain model ignores all policies set up on the computer so-far and allows all users almost administrator like rights. I need to override the domain's wishes and lock down the machine as if they were regular 2000pro users.

Basically, I need to set the machine to ignore what the domain tells it and force the user intoa profile that is restrictive... so far it seems like that NT does not have this basic security measure available.

by legj1

Users and Domain Users should not have the permissions to add software(however, I have been unable to stop some programs in the past, but they are few). Most Network Admins I know who have switched to Windows 2000 are setting their users up as POWER USERS which I totally disagree with. I have gone to hell and back by limiting permissions...especially with Office permissions conflicts (Users can't access Spell/grammar check in Word, Photo Editor won't open JPEG's due to permissions and the list goes on and on and on). However, are users are still under USER permissions. What software are your users installing? USER permissions should limit their sceevey little intentions.

by timgray

AOL, ICQ, download accelerator, IE prettifier (or whatever you call that damned program that shoves a picture in the IE toolbar) and just about every other "cutsie" worthless program out there that sales people love to install even after being told not to. From what I can gather as a regular domain user here you have power-user abilities. on that machine you cannot change their settings as they dont exist as far as user manager is concerned. on every machine all you see is administrator and guest. noone else, not even people who have logged in before. I cannot find any way to specify that all users that log in are forced into profile (x). Microsoft tells me that it cant be done, and I have to change their permissions atthe domain level. This is not an option as I am not the domain administrator, and the person running the domain could care less.

I have taken a stock W2Kpro install joined the domain, and then had a domain user log in. They were able to install VNC, and 4 other software packages.

I'm beginning to believe that in a domain model... it can't be done.

by mcse2000bound

One option is to create a roaming mandatory profile. You can set up the profile so that people can save whatever they want, however when they do not retain the programs that they installed. So in essence, you can let them go through the burden of trying to install their "cutesy" programs every day and they will eventually get bored with the process.

by timgray

his would be fine and is a great solution if I was the domain administrator. I have 0 domain administration rights and the domain administrators do not care what the front line techs have to deal with or want. The solution has to be machine specific. I.E 1 machine that doesn't care who you are from a login, it locks you down hard.

by shanghai sam

Another great solution but at a cost of $3,900.00 that management will not release. ($39.00 times 100) the solution I need has to be a function that is built into NT/2000 or is a free (or very low cost, Less that $500.00 for 100PC's.. I know, stop laughing... but they are laying off people here on a regular basis, management will not spend any money unless I can show that the solution will save at least 4X the amount spent in 30 days.... It's all about cash flow to management.)

by timgray

It seems that Windows 2000 sufferes from the same security problems that NT4.0 has. ther e is a basic security measure that is in every Unix system cince 1987 that NT does not have and looks like it will never have. the ability to keep users that are logged in from a central login authority (PDC) from having almost administrator like rights unless you are the manager of the PDC and then it's either network wide or not at all.

There is NO way to lock down one NT computer without spending money to add the functionality that is supposed to be there in the first place. Another reason to seriously look at alternatives to Microsoft Operating systems.

This discussion is closed to new replies.