Group Policy and deny install

[Guest]

Hi, I want deny to users that install software on yours PC's.
I did this:
In Computer Configuration>Administrative Templates>Windows
Components>Windows Installer
Enable-Always -> Disable Windows Installer

That is ok in .MSI files, but, how I can deny that the users install
programs .EXE in yours PC's by Group policies...????

Thank's

 

[Mark Heitbrink [MVP]]

Hi,

Hi, I want deny to users that install software on yours PC's. [...]

There is no existing right: "Software Installation"
You can´t deny it. Some programs don´t need an install, they can
just be run after extraction.

The user will always find a place where he can write files.
e.g. %temp% will always work.
You can try to work with SRP (Software restriction polcies) an deny
every execution from a share or source that you don´t have manually
definied.

Mark

 

[Guest]

Hi,

You are far better off doing this with NTFS Security Permissions. Users
cannot install what they cannot write to. All my drives are Users=Read. Even
the Temp Directory. Users profiles are mandatory roaming and delete on logoff
so even if they install into it, it is gone on logoff.

Cheers,

Lara