Prohibiting software installation

  • Thread starter Thread starter Matt Cox
  • Start date Start date
M

Matt Cox

Is there a way with Group Policy to allow a user Admin access to their local
computer but remove their ability to run Setup.exe so they can't install
software?

Thanks,

Matt
 
They are members of a AD group that is a member of the local Administrators
group on the PC so they have admin access.

We want the people to still have administrator privileges but not be able to
install new software, i.e. running a Setup.exe file.

Thanks,
 
Lock down access by deny the %ProgramFiles% for that particular group. how
ever if you're running Windows Server 2003 and XP there is a better way

--
Regards,

Christoffer Andersson
No email replies please - reply in the newsgroup
If the information was help full, you can let me know at:
http://www.itsystem.se/employers.asp?ID=1
 
It is next to impossible to restrict an administrator on a computer. You can try to
restrict an administrator via ntfs permissions and Group Policy by adding programs
such as setup.exe to the disallowed list as described in the KB link below. This may
dissuade the less knowledgeable, but a determined user will find how to bypass
restrictions including creating a local administrator account to logon to so that
user configuration does not apply. XP Pro offers Software Restriction Policies that
are very powerful and can also apply to administrator via computer policy unless of
course they decide to unjoin the computer from the domain. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;323525
http://support.microsoft.com/?kbid=310791
 
Back
Top