GPOs to restrict users from installing "unspecified" softw..

Archived from groups: microsoft.public.win2000.active_directory (More info?)

There is one main program that we use for our company. It is set up so
that it automatically "installs" when you open up that software. That
way if the software is updated after hours, when logging on and opening
the software, everyone will always be using the most updated version of
the software. To be able to "install" the most updated version when
you open the software they have to be administrators, right?

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Unfortunately there's not a whole lot I can do to change the design of
the application, so are there any suggestions for where I should go
from here.

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Unfortunately there's not a whole lot I can do to change the design of
the application, so are there any suggestions for where I should go
from here.

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Unfortunately there's not a whole lot I can do to change the design of
the application, so are there any suggestions for where I should go
from here.

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Sounds like poor design of that application to me.

As Tomasz says, an administrator is an administrator. All you can attempt
to do is to put enough hurdles in your users' way that they don't try to
install software. An administrator can always undo anything you do.

One option, if you were using Windows XP, would be to use software
restriction policies.

Hope this helps

Oli



<tengel82@hotmail.com> wrote in message
news:1108597508.366031.321660@f14g2000cwb.googlegroups.com...
> There is one main program that we use for our company. It is set up so
> that it automatically "installs" when you open up that software. That
> way if the software is updated after hours, when logging on and opening
> the software, everyone will always be using the most updated version of
> the software. To be able to "install" the most updated version when
> you open the software they have to be administrators, right?
>

Archived from groups: microsoft.public.win2000.active_directory (More info?)

tengel82@hotmail.com wrote:
> How can I use GPOs to restrict users from installing "unspecified"
> software on their client computers, while they are local administrators
> on their client computers.
>

They are administrators - simply You can't deny something to this users
on local machine - If you put NTFS ACLs they will take ownership of the
folders and change them .. so the first thing is to take them out of the
local admin group.

--
Tomasz Onyszko [MVP]
T.Onyszko@w2k.pl
http://www.w2k.pl

Archived from groups: microsoft.public.win2000.active_directory (More info?)

I was told that Generally the member of Power Users Group have the rights of
software installation.
In additional to "Security Template",anyone can show me how to use?
<tengel82@hotmail.com> wrote in message
news:1108597508.366031.321660@f14g2000cwb.googlegroups.com...
> There is one main program that we use for our company. It is set up so
> that it automatically "installs" when you open up that software. That
> way if the software is updated after hours, when logging on and opening
> the software, everyone will always be using the most updated version of
> the software. To be able to "install" the most updated version when
> you open the software they have to be administrators, right?
>

Archived from groups: microsoft.public.win2000.active_directory (More info?)

I'd say you have two choices. One is to remove users from the local admin
group and deploy updates to the software manually. The other is to upgrade
to Windows XP and use software restriction policies to make it awkward (but
not impossible -- they're administrators after all) for them to install new
software.

Oli


<tengel82@hotmail.com> wrote in message
news:1108600297.155040.49270@g14g2000cwa.googlegroups.com...
> Unfortunately there's not a whole lot I can do to change the design of
> the application, so are there any suggestions for where I should go
> from here.
>