Our forums are currently in maintenance mode and the ability to post is disabled. We will be back up and running as soon as possible. Thanks for your patience!

General discussion


Restrict USERs install by GPO

By sivaprakashsk ·
Hi everybody,
I am having 40 windows2000 clients ans 20 XP clients.(60 users),My server is Windows 2000server.
Now i want to configure 30 users should not have a installation permissions on their systems,but 20 users have a installation rights.all the systems accept software installations depends the user rights.
how can I configure these setup by using GPO.? should i create a 2 or more GPO? please help me.

thanks in advance.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

by BFilmFan In reply to Restrict USERs install by ...

Windows 2000 users can install old-style "setup.exe" software, basically, where they have access. However, the news is slightly better for Windows 2000 clients if your users want to install .MSI files. Most MSI files will be restricted from completing installation (such as Office 2000 and higher). Note, that this is 100% .MSI file dependent, and the operating system has very little to prevent it.

The news is somewhat better for Windows XP clients. If you delve into Software Restriction Policies with Windows XP clients, you'll really get fine control over which applications can and cannot run.

So the best answer is to:

Not allow local accounts on workstations.

Allow only domain user accounts to be placed into the local administrators group on the workstations you wish to allow install software.

Software Restriction Policies will only work with Windows 2003 or XP clients; thus, until those systems are upgraded, the creation of software restriction GPO's will buy you limited prevention.

This Microsoft article covers the XP Software Restriction Policies:

Related Discussions

Related Forums