Windows Forum

Ask something
Discussion Locked

Restrict USERs install by GPO

0 helpful
1 reply

by sivaprakashsk

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi everybody,
I am having 40 windows2000 clients ans 20 XP clients.(60 users),My server is Windows 2000server.
Now i want to configure 30 users should not have a installation permissions on their systems,but 20 users have a installation rights.all the systems accept software installations depends the user rights.
how can I configure these setup by using GPO.? should i create a 2 or more GPO? please help me.

thanks in advance.

1 reply

by bfilmfan

Windows 2000 users can install old-style "setup.exe" software, basically, where they have access. However, the news is slightly better for Windows 2000 clients if your users want to install .MSI files. Most MSI files will be restricted from completing installation (such as Office 2000 and higher). Note, that this is 100% .MSI file dependent, and the operating system has very little to prevent it.

The news is somewhat better for Windows XP clients. If you delve into Software Restriction Policies with Windows XP clients, you'll really get fine control over which applications can and cannot run.

So the best answer is to:

Not allow local accounts on workstations.

Allow only domain user accounts to be placed into the local administrators group on the workstations you wish to allow install software.

Software Restriction Policies will only work with Windows 2003 or XP clients; thus, until those systems are upgraded, the creation of software restriction GPO's will buy you limited prevention.

This Microsoft article covers the XP Software Restriction Policies:

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx

This discussion is closed to new replies.