Sign in with
Sign up | Sign in
Your question

using GPO to prevent software installs

Last response: in Windows 2000/NT
Share
Anonymous
June 7, 2004 7:45:43 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

I realize Windows 2003 has "Software Restriction Policy", but is there
anything analogous for Win 2K domains? Even 3rd party tools? We run a lot of
legacy apps (who doesn't) and excluding everyone from the local admin group
is not always an option. Besides, a lot of apps downloaded from the Internet
can be "installed" by users without Admin privileges.

There are many band-aid solutions (like preventing users from running
SETUP.EXE via GPO, for example), but I can't believe that there isn't a good
solution out there.

d.
Anonymous
June 8, 2004 2:06:13 AM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

There may be third party applications that can try to lockdown a user, but I
think the money is better spent on upgrading to XP Pro and you can use
Software Restriction Policies on Windows XP Pro computers in a W2K domain by
upgrading the admin templates as described below. I know of no other way
through Group Policy than the ways you mention of either disallowing a list
of Windows applications or allowing only those applications/executeables in
the allowed Windows application list. --- Steve

http://www.microsoft.com/windowsxp/pro/using/itpro/mana....
asp

"Derek Marshall" <derekm@tomsofmaine.com-no spam> wrote in message
news:o AaFGgMTEHA.1168@TK2MSFTNGP11.phx.gbl...
> I realize Windows 2003 has "Software Restriction Policy", but is there
> anything analogous for Win 2K domains? Even 3rd party tools? We run a lot
of
> legacy apps (who doesn't) and excluding everyone from the local admin
group
> is not always an option. Besides, a lot of apps downloaded from the
Internet
> can be "installed" by users without Admin privileges.
>
> There are many band-aid solutions (like preventing users from running
> SETUP.EXE via GPO, for example), but I can't believe that there isn't a
good
> solution out there.
>
> d.
>
>
Anonymous
June 8, 2004 8:01:53 AM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

Derek,
I also like XP's software restriction policies but you also asked
about third party proucts

Sanctuary may help you out, you may have heard of it when it was
called SecureEXE

http://www.securewave.com/

"Steven L Umbach" <n9rou@nscomcast.net> wrote in message news:<pF5xc.55555$3x.35191@attbi_s54>...
> There may be third party applications that can try to lockdown a user, but I
> think the money is better spent on upgrading to XP Pro and you can use
> Software Restriction Policies on Windows XP Pro computers in a W2K domain by
> upgrading the admin templates as described below. I know of no other way
> through Group Policy than the ways you mention of either disallowing a list
> of Windows applications or allowing only those applications/executeables in
> the allowed Windows application list. --- Steve
>
> http://www.microsoft.com/windowsxp/pro/using/itpro/mana....
> asp
>
> "Derek Marshall" <derekm@tomsofmaine.com-no spam> wrote in message
> news:o AaFGgMTEHA.1168@TK2MSFTNGP11.phx.gbl...
> > I realize Windows 2003 has "Software Restriction Policy", but is there
> > anything analogous for Win 2K domains? Even 3rd party tools? We run a lot
> of
> > legacy apps (who doesn't) and excluding everyone from the local admin
> group
> > is not always an option. Besides, a lot of apps downloaded from the
> Internet
> > can be "installed" by users without Admin privileges.
> >
> > There are many band-aid solutions (like preventing users from running
> > SETUP.EXE via GPO, for example), but I can't believe that there isn't a
> good
> > solution out there.
> >
> > d.
> >
> >
Anonymous
June 8, 2004 1:34:04 PM

Archived from groups: microsoft.public.win2000.group_policy (More info?)

I also looked at http://www.faronics.com/html/Freezex.asp. My fear in a 3rd
party app is the conflict that would undoubtedly arise when using GPO to
deploy apps. I will probably rely on written policy and moving to XP soon.

D.

"Mike Kline" <mkline@gmail.com> wrote in message
news:7ce5de03.0406080301.1a4c122f@posting.google.com...
> Derek,
> I also like XP's software restriction policies but you also asked
> about third party proucts
>
> Sanctuary may help you out, you may have heard of it when it was
> called SecureEXE
>
> http://www.securewave.com/
>
> "Steven L Umbach" <n9rou@nscomcast.net> wrote in message
news:<pF5xc.55555$3x.35191@attbi_s54>...
> > There may be third party applications that can try to lockdown a user,
but I
> > think the money is better spent on upgrading to XP Pro and you can use
> > Software Restriction Policies on Windows XP Pro computers in a W2K
domain by
> > upgrading the admin templates as described below. I know of no other
way
> > through Group Policy than the ways you mention of either disallowing a
list
> > of Windows applications or allowing only those applications/executeables
in
> > the allowed Windows application list. --- Steve
> >
> >
http://www.microsoft.com/windowsxp/pro/using/itpro/mana....
> > asp
> >
> > "Derek Marshall" <derekm@tomsofmaine.com-no spam> wrote in message
> > news:o AaFGgMTEHA.1168@TK2MSFTNGP11.phx.gbl...
> > > I realize Windows 2003 has "Software Restriction Policy", but is there
> > > anything analogous for Win 2K domains? Even 3rd party tools? We run a
lot
> > of
> > > legacy apps (who doesn't) and excluding everyone from the local admin
> > group
> > > is not always an option. Besides, a lot of apps downloaded from the
> > Internet
> > > can be "installed" by users without Admin privileges.
> > >
> > > There are many band-aid solutions (like preventing users from running
> > > SETUP.EXE via GPO, for example), but I can't believe that there isn't
a
> > good
> > > solution out there.
> > >
> > > d.
> > >
> > >
!