Windows Forum

Ask something
Discussion Locked

Local User Policies

0 helpful
3 replies

by robw

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have a situation where a number of our NT/2000 Workstation users on the LAN need to have local Administration rights to their machine. At the same time we want to prevent people from installing software themselves.

I know that through the default domain policy we can shut off certain way of the users initiating an install of a program, yet that still does not stop them from downloading programs and installing them or popping in a CD and manually starting an install...

The first thought might be to simply take away local admin rights...but certain software we have onsite will not run without local admin rights for the user...

Any thoughts on how to tackle this issue of dis-allowing people with local admin rights from installing software?

3 replies

by curacao_dejavu

Did you contact the manufacturer of the software on how to normal users can run the software.
Usually they need 1: permissions on the install folder ; 2: permissions in the registry (regedt32) hkeylocalmachine\software\softwarename

or sometimes I give them temporary admin rights just to install, and then I remove the admin rights.
When you get that worked out you can apply permissions on the program files folder so so admins and the system account has full control, the every one group has to have at least list rights to function (but thtat depends of the software, they may need more).

Or you can put domain admin rights on the program files folder, so the local admin can not install.

I would suggest again to contact to manufacturer first.

success,

Leopold

This discussion is closed to new replies.