gpo

[splat78423]

what are the best GPO settings to prevent users from downloading and installing programs?

 

[markdmac]

You will need to address this in several areas.

First you will want to lock down IE to prevent the SaveAs menu choice. You will find this under Internet Explorer Maintenance in your GPO.

That will block saving from the Internet. To prevent installing software you need to address this at the workstation security side.

Remove all of your users from Power Users or Local Administrators and add Domain Users to the local Users group. This group does not have rights to install software.

Please also refer to this thread which I recently addressed this same question. thread779-1213473

I hope you find this post helpful.

Regards,

Mark

 

[58sniper]

A caution on blocking the SAVE AS feature, as business needs may dictact otheriwise. For example, we have a LOT of law firms as clients, and they have to save .pdf files from court websites. Make sure there is no business need to save files from the web.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[markdmac]

An excellent warning. Finding the proper balance of security and functionality is always the hardest part of securing an environment.

I hope you find this post helpful.

Regards,

Mark