Sign in with
Sign up | Sign in
Your question

GPOs to restrict users from installing "unspecified" softw..

Last response: in Windows 2000/NT
Share
Anonymous
February 16, 2005 6:18:03 PM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

How can I use GPOs to restrict users from installing "unspecified"
software on their client computers, while they are local administrators
on their client computers.

We are using a Windows 2000 domain, with windows 2000 servers and
Active Directory
Anonymous
February 16, 2005 6:45:08 PM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

There is one main program that we use for our company. It is set up so
that it automatically "installs" when you open up that software. That
way if the software is updated after hours, when logging on and opening
the software, everyone will always be using the most updated version of
the software. To be able to "install" the most updated version when
you open the software they have to be administrators, right?
Anonymous
February 16, 2005 7:31:37 PM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Unfortunately there's not a whole lot I can do to change the design of
the application, so are there any suggestions for where I should go
from here.
Related resources
Anonymous
February 16, 2005 7:36:53 PM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Unfortunately there's not a whole lot I can do to change the design of
the application, so are there any suggestions for where I should go
from here.
Anonymous
February 16, 2005 7:48:18 PM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Unfortunately there's not a whole lot I can do to change the design of
the application, so are there any suggestions for where I should go
from here.
Anonymous
February 17, 2005 3:03:16 AM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Sounds like poor design of that application to me.

As Tomasz says, an administrator is an administrator. All you can attempt
to do is to put enough hurdles in your users' way that they don't try to
install software. An administrator can always undo anything you do.

One option, if you were using Windows XP, would be to use software
restriction policies.

Hope this helps

Oli



<tengel82@hotmail.com> wrote in message
news:1108597508.366031.321660@f14g2000cwb.googlegroups.com...
> There is one main program that we use for our company. It is set up so
> that it automatically "installs" when you open up that software. That
> way if the software is updated after hours, when logging on and opening
> the software, everyone will always be using the most updated version of
> the software. To be able to "install" the most updated version when
> you open the software they have to be administrators, right?
>
Anonymous
February 17, 2005 3:30:55 AM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

tengel82@hotmail.com wrote:
> How can I use GPOs to restrict users from installing "unspecified"
> software on their client computers, while they are local administrators
> on their client computers.
>

They are administrators - simply You can't deny something to this users
on local machine - If you put NTFS ACLs they will take ownership of the
folders and change them .. so the first thing is to take them out of the
local admin group.

--
Tomasz Onyszko [MVP]
T.Onyszko@w2k.pl
http://www.w2k.pl
February 17, 2005 11:47:10 AM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

I was told that Generally the member of Power Users Group have the rights of
software installation.
In additional to "Security Template",anyone can show me how to use?
<tengel82@hotmail.com> wrote in message
news:1108597508.366031.321660@f14g2000cwb.googlegroups.com...
> There is one main program that we use for our company. It is set up so
> that it automatically "installs" when you open up that software. That
> way if the software is updated after hours, when logging on and opening
> the software, everyone will always be using the most updated version of
> the software. To be able to "install" the most updated version when
> you open the software they have to be administrators, right?
>
Anonymous
February 18, 2005 2:59:44 AM

Archived from groups: microsoft.public.win2000.active_directory (More info?)

I'd say you have two choices. One is to remove users from the local admin
group and deploy updates to the software manually. The other is to upgrade
to Windows XP and use software restriction policies to make it awkward (but
not impossible -- they're administrators after all) for them to install new
software.

Oli


<tengel82@hotmail.com> wrote in message
news:1108600297.155040.49270@g14g2000cwa.googlegroups.com...
> Unfortunately there's not a whole lot I can do to change the design of
> the application, so are there any suggestions for where I should go
> from here.
>
!