Prevent Software Installation

[JoshuaThompson]

We are deploying Windows 7 (x64) and have recently noticed that some applications (firefox, chrome browser) can be installed without admin credentials. The user receives the UAC prompt (which is set at the highest level), but they can just click "No" on the UAC prompt when asked for entering credentials and the software installation continues with no more questions ask.

If the user attempts to install to Program Files, Program Files (x86) or the root of C: then the installation fails but the user can install to ProgramData or their user profile directory with no questions asked.

I know applocker can prevent software from running, but how can I prevent software from installing?

This sounds like a major flaw.

 

[linney]

Applocker, I thought, would prevent Windows Installers from running and third party Setup.exe?

"What types of files can I manage with AppLocker?

AppLocker can be used to manage four different types of files: executable (.exe), Windows Installer (.msi and .msp), script (.bat, .cmd, .js, .ps1, and .vbs), and DLL (.dll and .ocx). Each of these file types is managed in its own rule collection."

AppLocker: Frequently Asked Questions

http://technet.microsoft.com/en-us/library/ee619725(WS.10).aspx

See what others are doing in the Server Forums.

http://www.tek-tips.com/threadminder.cfm?pid=1674

 

[JoshuaThompson]

Thank you for the reply. That is good information.

Unfortunately after some research it appears as though Applocker will only work in the Enterprise and Ultimate editions. We currently run Windows 7 Professional.

"Windows 7 professional can be used to create applocker rules. however, applocker rules cannot be enforced on computers running windows 7 professional"

I ran a quick test of a firefox install on XP and it installed as well with no admin rights. So it looks like this is not new to Windows.

This sounds like a pretty big flaw in security.

 

[dilettante]

You might take some time to read through Using Software Restriction Policies to Protect Against Unauthorized Software.

 

[linney]

It sounds like you have to use a mixture of the old and new to get total control.

See "AppLocker on Windows 7 and on Windows Server 2008 R2"
Description of the Software Restriction Policies in Windows XP

http://support.microsoft.com/kb/310791

Maintaining AppLocker Policies

http://technet.microsoft.com/en-us/library/ee791870(WS.10).aspx