How can I disable a user from installing IIS on W2KPro?

[TeachMeC]

I am deploying 850 copies of W2KPro in my organization and don't want anyone -- even a local administrator -- to see IIS on the list of Windows components that can be installed. We are building a prototype system that will be cloned using Ghost to the 850 other machines. Does anyone know how to control what components appear in the Control Panel/Add Remove Programs, Windows Components list?

We don't want any web servers running anywhere in the organization except the official, protected, web server that our webmaster configures and runs. There are too many worms out there for my taste.

 

[butchrecon]

You can use the LOCAL COMPUTER policy editor to set what can be used on the system. The issue is that ANY local admin can change that policy. If you make aal the users POWER USERS then they will have to use what ever local policy you set. James Collins
Systems Support Engineer
A+, MCP

email: butchrecon@skyenet.net

Please let us (Tek-tips members) know if the solutions we provide are helpful to you. Not only do they help you but they may help others.

 

[TeachMeC]

Thanks. Yes, we could use the policy editor, and yes, we are making MOST ALL of the users PowerUsers rather than administrators, but we will be forced to make more users into Local Administrators than we want AND these are the users most likely to get creative with their PCs and want to experiment with serving web and ftp. Maybe I am getting paranoid, but I just wanted a way of physically disabling the feature to install IIS on W2KPro without having the CD.

 

[butchrecon]

I am unsure you can do that for anyone who has local admin rights. You may be in a situation where you post the things they should not do that can be punishable. You may need to create new rules for employees with local admin rights. But anytime someone is given local admin rights they pretty much have a liscence to do what they want unless you restric with written rules. James Collins
Systems Support Engineer
A+, MCP

email: butchrecon@skyenet.net

Please let us (Tek-tips members) know if the solutions we provide are helpful to you. Not only do they help you but they may help others.

 

[TeachMeC]

Thanks again. In addition to being desktop manager (responsible for the roll-out of W2KPro) I am also the security manager. Trying to wear both hats at the same time. I was hoping that there was an .msi file, or some other scripted resource that would list what components show up in the list. Or even if there were some .dll files that could be renamed, or deleted that would keep it from working. Many of our "Local Admin" type users are developers and gurus who just want to play with the new toys. Some have NT 4.0 now and are already LAs and I would like to make them Power Users instead, but it is going to be a hard sell. My boss wants to both lower TCO and Please All Users at the same time. A tough call.

 

[butchrecon]

Very tough call. Just like NT4 and one with local admin privlages can do anything they wany on the PC. It stinks. I will do more research and see if you can limit local admin abilities. James Collins
Systems Support Engineer
A+, MCP

email: butchrecon@skyenet.net

Please let us (Tek-tips members) know if the solutions we provide are helpful to you. Not only do they help you but they may help others.

 

[polymath5]

I don't think you can limit administrators rights in any way. Particularly a local admin on the local machine. After all, if you did limit the rights, who could give them back? The very definition of Administrator precludes limitations.

I would love to be shown that my conclusion is wrong, I could find some uses for doing it myself!