Group Policy Gurus...

[live4spd]

Got a question with group policys. First of all this is a Active Directory environment with Win2k and W2003 servers. Clients are all WinXP machines.

Anyway, how can I disable users from installing anything? I'm assuming this is some feature within Group Policy?

Thanks!

Ryan

 

[Saltin]

As long as the domain accounts are not a memeber of the local admin or power users group on the computer in question, users have no rights to install software by default.

 

[live4spd]

Ah, well that might be my problem then. I believe I have the "everyone" group in my local machine admins group.

 

[mikecel79]

Originally posted by: Saltin
As long as the domain accounts are not a memeber of the local admin or power users group on the computer in question, users have no rights to install software by default.

Generally this is true but there is some software that doesn't write to the HKLM keys but instead uses HKCU which a logged in user has full rights too. This type of software they will be able to install.

 

[live4spd]

So is there anyway to disable the windows installer in group policy?

Ryan

 

[Zuke]

yes - there is.

In the relevant OU, open up group policy - /administrative templates/windows components/Windows Installer

There are a slew of options you can configure for Windows Installer - one of which is "Disable Windows Installer." You'll want to "enable" this. Kind of counter-intuitive at first, (you have to enable the policy that disables the installer) but that's the way it works.