NT Security - Users Installing Software

You need to use the system policy editor and create system policies. These will control what users or groups of users can and cannot do.

System policies.

The administrator can use system policies to specify required system settings and to restrict network access, security privileges, and system settings from a convenient central source. Policies can be specified for groups, for specific users, and for multiple computers, providing administrators significant control over users' ability to configure computer and desktop settings. For information, see Chapter 15, "User Profiles and System Policies."

Check out: http://www.microsoft.com/technet/index/default.asp for lots of info on how to do stuff in a windows environment.

You can prevent installation of software that requires registry modification just by making sure the users are not administrators or power users on the desktop.

For other packages, you can use mandatory profiles. It doesn't completely prevent installation of software but it takes all the fun out of it by making it all disappear from the desktop when you re-boot.

Be careful, though, because one of the unintended consequences of what you're trying to do can be that users can't even do the things they need to do (update virus definitions, attach to a printer, etc) to operate effectively.

paul

Level 1
By not adding users admin local rights you will prevent registry updates, and it will be more easy than a policy.
Level 2
Set up policies and disable the run commnad, the network icon, etc.

Keep on mind that many of this changes will impact in your users daily tasks. Many of them will need to run a dos command or install a provided software.
Against you, if you remotely install software and manage printers, etc
So be carefull..