Creating Custom group for local XP Pro SP2 machine

  • Thread starter Thread starter Josh Mikow
  • Start date Start date
J

Josh Mikow

Here's what we want to be able to do. If someone could let me know if it is
even feasable that would be great.

Domain user is logged into local Windows XP Pro SP2 machine (mobile laptop
not always connected to domain).

They are currently setup as a User and not allowed to add/remove programs.

They need the ability to Start/Stop services because of the demos that they
run have settings they need to change.

There are also some settings in IE that don't seem to work as a user, but do
as Administrator.

Can anyone help me know if it is possible to restrict add/remove programs
but allow start/stop services?

Thanks,

Josh Mikow
 
You can use Group Policies to restrict access to the Add/Remove Programs applet and to prevent installs from MSI installer packages. However, this will not prevent them from using a direct installer to install software.

You may be better off making them Power Users and simply auditing the software installed on the computer, and make it clear that software not provided by your organization is not allowed to be installed. Be prepared to make an example of the first one you catch.
 
Doug,

Thanks for the suggestion. I was afraid I wouldn't be able to achieve both
goals with 1 policy.

How would we go about auditing the software installed?

I was thinking of using Norton CleanSweep to monitor what is installed, but
is there a better way to do the same thing?

Josh



You can use Group Policies to restrict access to the Add/Remove Programs
applet and to prevent installs from MSI installer packages. However, this
will not prevent them from using a direct installer to install software.

You may be better off making them Power Users and simply auditing the
software installed on the computer, and make it clear that software not
provided by your organization is not allowed to be installed. Be prepared
to make an example of the first one you catch.
 
Doug,

I just tried using your Security Console to restrict access to the computer
for our user and I ended up securing myself from making more changes. How
can I get back to make changes to the settings of the current user?

Josh


There are tools such as Belarc Advisor, www.belarc.com and others. Some
examples are listed here.

http://www.handyarchive.com/free/software-inventory/

None are free, though for Corporate use. Another method might be a logon
script that reads the uninstall information in the Registry, and reports any
"extra" software it finds to a log file on a network share.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
 
E-mail me at support @ dougknox.com with the exact details of the problem you're having.
 
Back
Top