prevent users from installing s/w

The O/S are Win 95 & Win 98SE

The only "off-the-shelf" way of preventing installation of general software is to *not* have users in the Administrators group of the local account database -- however, this will not allow them to install *any* software. A third-party product may be available to give you the granularity you require.

BTW, I say general software because the method above actually only provides specific access to specific files and folders to users other than "Administrators". An application that does not add or modify the registry and that does not add files in system areas or that does not replace system files can, in fact, be installed by Joe User.

A good way to prevent users from installing things that they shouldn't is to use the registry to hide the drives and try to disable all ways to access them. Programs like Customizer98 and TweakUI 2000 can do this. This in combonation with the PolicyEditor could prove useful in your efforts.

Another way,but rather extreme, is to disconnect the drives internally. All you have to do is disconnect the power cable and/or the IDE cable for that drive. On the brighter side, you won't have to install and configure anything and you won't run the forever popular risk of messing up the registry.

Have Fun!!

The most direct way to do this is to set up profiles (NT 4 network) or security policy (Windows 2000 network) for the machine when it logs onto the network. This will not stop the user from doing anything when not on the network, but will stop them cold when they are logged in.

There is no 100% surefire way of stopping them when they are off the network when using 9x. If these were NT clients, you could restrict the local machines to admin installs only.

Since most machines participate in a network, using profiles or security policies (depending on the network) is the best option.

If this is not an option (workgroup?), remove CD-ROM drives and put a CD-ROM carousel or drive on the domain or workgroup. Put it in a locked room, andonly allow admins to load the CD-ROMs. This requires installs across the network, but it is a method to stop people from fragging their machines with stupid software.

In a Windows 2000 network, it is much easier to restrict this, even with older clients.

Both the windows site (www.microsoft.com/windows) and the MSDN site (msdn.microsoft.com) will have info on profiles and policies.

Gregory A. Beamer
MCP: +I, SE, SD, DBA

This question was closed by the author