RE: How to block users from installing other apps

You didn't mention what the client OS is, but I'll assume Windows 2000. I'm not sure if it really matters any way.

Through Group Policies in Acitve Directory or Local Policies on the individual machines, you can control what exe's are allowed to be launched. Last time I did this was on a Windows 95-based production environment so it's probably changed a little. Just add in the exe names for the applications that you want them to run and everything else would be blacked.

However, an easy way around this would be to rename AIM.exe to whatever_is_allowed.exe. I would recommend testing this to make sure I haven't made any wrong assumptions.

Good Luck.. It really is an HR issue, not a technical issue.

Oh, yeah. Wesly Noonan hit it on the nose.. Bad application design is the real issue.

.:: Matt ::..  

Bother!, said Pooh as his network froze..

-----Original Message-----

From: Jane Han [mailto:janehan22@yahoo.com] Sent: Wednesday, June 25, 2003 2:22 PM
To: focus-ms@securityfocus.com
Subject: How to block users from installing other apps

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Due to several customized inhouse applications, the users need to be local aministrator to lauch the applications.  Since most users are local admin, they can download and install applications such as games, AOL instant messages...from internet. 

Is it possible to block users from installing applications through Group Policy in this case?  or disable internet explorer?

Any solutions or suggestions?

Thanks in advance,
Jane