Prevent User Installations?

Grant the users only USER rights to the domain and make sure that none of them are listed under the Administrators group on the individual machines.

Have you looked into the Zero Administration Kit? It's supposed to be able to prevent users from installing software.

See http://support.microsoft.com/support/kb/articles/Q170/2/71.ASP

The zero admin kit from microsoft is a good utility. You could also implement system policies and lock down the computers/users that way.

What we've done is implament "System Policies" that will allow only specified programs to run.
The users will download tjings but cannot run the exe to in stall or run an unwanted program.
This can be an administrative headache but by using GlobalGroups and using seperate Policies for each, it's not too bad.

You could use the System Policy editor in Administrative tools. What I do is "Create new policy", add group, choose group (e.g. Sales, Accounting, whatever), double-click icon, and under the "system" category check "Run only allowed Windows applications". Add your specific applications by clicking the "Show" button and typing in the file names (e.g. winword.exe or iexplore.exe). When done setting policy save file as "NTconfig.pol" and save it to: \WINNT\system32\Repl\Import\Scripts. This will effect all NT workstations logging in to the domain. If you have any 95 or 98 clients you can also do this using the Resource kits for the specific OS.

Hope this helps.

I don't have the solution but I can tell you that System Policies while good are cumbersome when you are picking the programs that are authorized. Even as a user you can still install programs. They may however not install completely and cause even more damage.

I have had great success with a product called Full Armor.
Here is a contact to try for yourself and evaluate the software in your settings.

Gregory John Moscatel
Full Armor Corporation
129 South Street
Boston, MA 02111
1-800-653-1783 x228
http://www.fullarmor.com

If the users are in the local administrator group remove them and put them in the user or power users group. They should not be able to install any software while a member of those groups.

If they are downloading the software via their workstaions thru the internet. You could set the security settings of their web browser to disable file downloads or disable at the proxy server level.