Blocking Software Instalation

  • Thread starter Thread starter Mark McCurdy
  • Start date Start date
M

Mark McCurdy

As the admin I have been tasked with locking down desktop machines from
installing software. This means everything (if possible). Should I do this
by a policy? I'd like to lock down C drives so they can not be accessed by
"Joe User" other than reading. Any suggestions? Policy?

Thank you
Mark
 
Making you users not a local Admin (normal users) will prevent almost all
software installs and prevent them from writing to your system disk. Make
your users only Read access to your c: drive. You could use GPO's to allow
only specific applications to be run on your system, but this depends on the
work your users are doing. Of course test this in your lab prior to
production deployment.
you can use various GPO's to block your users from running specific system
applications (Control panel, Command prompt, Run command, Task Manager,...),
hide the drives that they don't need access to, etc,..

--
Regards

Matjaz Ladava, MCSE, MCSA, MCT, MVP
Microsoft MVP - Active Directory
(e-mail address removed), (e-mail address removed)
http://ladava.com
 
That's the strange thing. My users are NOT local admins and most software
they can't install but there is this annoying Outlook add on feature they
are installing. It add's smiley icons etc and I'm guessing is being
downloaded from a webpage. For some reason they can install that.
 
Ahhh, this is HotBar (www.hotbar.com). Block this address in your
Proxy/Firewall and remove this software from users workstations. See
http://www.doxdesk.com/parasite/HotBar.html for more info on how to remove
it. Your users have probably write access to HKLM part of the registry.
Check your workstation file system security. Use Security configuration and
analysis snapin to analyze your workstations to see where are the holes.

--
Regards

Matjaz Ladava, MCSE, MCSA, MCT, MVP
Microsoft MVP - Active Directory
(e-mail address removed), (e-mail address removed)
http://ladava.com
 
Back
Top