RE: How to block users from installing other apps

          You have several options, depending on whether you're using Windows 2k3 or 2k. You can block the "Add/Remove programs" from the control panel or you can block the entire control panel. You can also disable IE. With W2k3, there is an available feature to block based on program path and an .exe hash. This has been discussed here in terms of security, but can also be used to prevent users from installing and running apps, if you have a specific list of apps that you want to block. Do remember that this feature only works on Windows XP. There also additional software restriction rules that you can create in order to prevent the user from installing various applications. Another approach would be to NOT make the users local admins and just run/install apps with elevated privileges.         

Arthur Freyman         

afreyman@dsw.net

-----Original Message-----

From: Jane Han [mailto:janehan22@yahoo.com] Sent: Wednesday, June 25, 2003 1:22 PM
To: focus-ms@securityfocus.com
Subject: How to block users from installing other apps

Due to several customized inhouse applications, the users need to be local aministrator to lauch the applications.  Since most users are local admin, they can download and install applications such as games, AOL instant messages...from internet. 

Is it possible to block users from installing applications through Group Policy in this case?  or disable internet explorer?

Any solutions or suggestions?

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Thanks in advance,
Jane