preventing users from installing or downloading

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have a problem with some terminal server users managing to download and
install programs through Internet Explorer.
What policy do I modify to prevent this? or where is the policy to only
allow certian apps to run?
 
There are a couple of things you can do:

1. Set restrictive ACLs on directories & files, i.e. C:\, C:\Program Files,
C:\Windows,C:\Windows\System32 (this should be done when the system is first
built, as doing this retroactively can easily cause installed programs to
stop working. normal users usually do not need mere than Read & Execute
Permissions to these directories).

2. Use a software restriction policy, which specifically defines names of
authorized programs, others are blocked form execution.

Patrick Rouse
Microsoft MVP - Terminal Server
http://www.workthin.com
 
I have looked through the policies and can't find the one specific to
software restriction. I remember seeing it when I first set up the Win2k
server, just can't located now.
 
That object does not exist in Windows 2000 server. I understand it would be
better to have Windows 2003 to assign rights and policies, but that is not an
option at this point.

Looks like I am SOL.
 
There are other options, i.e.

1. NTFS Security (work very well, just requires testing to make sure you
don't break anything by "over locking down".

2. 3rd party Applications that control application usage. Claudio
Rodrigues makes one called WTSApp that costs only $299, which might be right
up your alley. You can find it at terminal-services.net. Other more
expensive programs are made by triCerat and Appsense.
 
Back
Top