Hello Ron.
You can disable Windows Installer for your users with a Group Policy, or
disable install from media. So you can publish Applications with Windows
Installer with Group Policys from your network, but users can't install from
media. but can still use media for files etc..
How ever this only prvent few Windows Installer based applications. i Should
change premission to the %SystemDrive%\%ProgramFiles% Directory. In fact you
can do this at once also with Group Policy. If some applications may need to
write in to the directory. You can allow users to modify , put still prevent
users from create new folders in SystemDrive%\%ProgramFiles% Directory.
If you want to do this mroe secure and more professional. i will point you
to Software Restriction Policies.
This will be applied by Group Policy, but this only works with Windows
Server 2003, and Windows XP at the client site.
i recomend you to read the "Best practices for software restriction
policies"
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/proddocs/standard/SRP_BP.asp
In a GPO:
a.. Group Policy Object [ComputerName] Policy
a.. Computer Configuration or
User Configuration
a.. Windows Settings
a.. Security Settings
a.. Software Restriction Policies
--
// Christoffer Andersson
Ron said:
I want to inhibit users from installing home software on their company
computers but yet allow them to change basic configuration settings. There
is a growing number of staff that want to connect PDA's to their company
computers. If I keep them as a Restricted User on the local machine to
prohibt home software, they cannot "sync" because they are prohibited as a
Restricted User. If I give them local Power User rights that permits them to
sync their PDA, they also have the rights to install home software. How can
I use local options or a group policy to let users change basic files
without letting them overwhelm company computers with home software?
