NT policy - simply stop user running install.exe or setup.exe!

[dasein47]

Hello,

This problem keeps plaguing me and I really wish there was an easy solution. Hence, this post.

I have a server farm of 4 terminal servers/citrix servers. Users keep downloading and installing software. This causes problems from various angles and I simply want to restrict them from doing this - nothing else.

The problem with using NT policies to do this seems to me to be this:
The only way to prevent users from installing software is to come up with a list of allowed executables (in poledit, System>Restrictions> Run only allowed Windows applications). This will deny any user trying to use anything other than what is explicitly listed. This is cumbersome to maintain. It is not very simple in trying to track down ALL of the *.exe files they need to be able to use. The problem with this is, this citrix server has many exe's and other dll's that need loaded in order to run about 15 programs.

Does anyone know of any easy way, (either with poledit or other NT tools OR with a third party utility) - that will easily allow an admin to deny any user to run install.exe or setup.exe?

Thanks in advance.

Dasein47

 

[aker]

Do they need to log onto the server to access many different programs, or do they just need one or two specific programs? This being the case, you can create an automatic logon and automatically execute the program in question. This disables their abilities (not 100%) to do damage, or use internet explorer. If this is what you want, go into connection manager and use the connection settings.
(At least this works on Windows 2000 Server). The other solution is to invest in some internet filtering program (cybersurf, etc) which disables certain features and also certain sites.