restricting users from installing software

[dadau]

Hello All,
How can I restrict users who are not administrators from installing software from CD's or Internet downloads?

TIA

 

[kjmattson]

Are these Standard Users (members of the power users group) or Restricted Users (members of the users group)? If you haven't already done so, make the users Restricted Users.

If your not already using it, use NTFS for the file format. The lack of registry permissions and file system permissions for a Restricted User will prevent installation of most software.

Unfortunately it is much more difficult to prevent installation of a program that makes no registry entries and can be run from a single executable located in the users home directory. To get around this problem you could set up a GPO that allows using only designated programs, however this could be a lot of work to administer.

Kevin Mattson
MCP

 

[SoulSe]

If you need your users to be power users, than try blocking write access to the Program Files folder (right click on program files, select "Security" tab and click on "advanced&quot.

As most programs attempt to install here by default, this could solve 80% of your problem. Of course, they could use alternative installation directories, but your average user should give up after the first "Cannot install to directory: Access Denied" message.