Hi all
I'm looking for a bit of advice from any GPO gurus out there please!
I have an environment with about 800 users, all of whom currently have local admin rights on their machines. We want to lock down their access to the machine, particularly in terms of not allowing them to add/remove programs anymore without IT department participation. So we thought the solution would be to implement a GPO changing everyone to just be a User on the local machine and take away certain control panel applets (eg Add/Remove Programs).
However, there are certain pieces of business critical software which need full control of areas such as %systemroot% and %systemroot%\system32 as well as the installation folder of the software itself. My question is this: does anyone know if it's possible to set local folder level permissions on our 800 machines via GPO? If not, do you know of a way to script/automate this in any other way? Obviously, it's simply not practical to visit every machine to set these permissions, so and advice would be gratefully received!!
Cheers
Graeme
I'm looking for a bit of advice from any GPO gurus out there please!
I have an environment with about 800 users, all of whom currently have local admin rights on their machines. We want to lock down their access to the machine, particularly in terms of not allowing them to add/remove programs anymore without IT department participation. So we thought the solution would be to implement a GPO changing everyone to just be a User on the local machine and take away certain control panel applets (eg Add/Remove Programs).
However, there are certain pieces of business critical software which need full control of areas such as %systemroot% and %systemroot%\system32 as well as the installation folder of the software itself. My question is this: does anyone know if it's possible to set local folder level permissions on our 800 machines via GPO? If not, do you know of a way to script/automate this in any other way? Obviously, it's simply not practical to visit every machine to set these permissions, so and advice would be gratefully received!!
Cheers
Graeme