How to prevent installation of any programs by a user in win xp?

[UnatcoAgent]

My little brother has continually messed up the family computer while I've been away from school, and I need to know how to limit his user account access, namely his ability to install anything. This is in Winxp pro, how would I go about doing this ?

 

[newParadigm]

Make a sperate use account for him, and put it in the User Group "Users".

Then Password protect any accounts with administartive privliges, so he can;t use a diff acount.

 

[btacular]

take away his administrative ability, use the windows help topic

not to difficult if i remeber correctly

 

[UnatcoAgent]

Originally posted by: newParadime
Make a sperate use account for him, and put it in the User Group "Users".

Then Password protect any accounts with administartive privliges, so he can;t use a diff acount.

That's already done, but how do I make it so he can't install anything when he's logged into his account? If I'm not mistaken he still has this ability when logged in before any restrictions have been applied.

 

[mechBgon]

If he is a Limited-class user, he should not be able to install software (easy enough to confirm that, try downloading and installing a program, perhaps FilZip or WinZip, while logged onto his account). You may also want to grab the SafeDisc patch so games on SafeDisc-protected CDs can run under Limited accounts.

To enforce the use of the right account, obviously you should password-protect all accounts, and also enable Fast User Switching. Another good idea: go to Start > Run and run gpedit.msc to open Group Policy Editor. Now drill down to User Configuration > Administrative Templates > Control Panel > Display and enable Screensaver, then enable Password-Protect Screensaver and enable the lockdown timer at some sensible setting, maybe 10 to 15 minutes. This way, if you happen to leave an Admin-class account logged on, at least it'll lock before too long and he'll be at the Welcome screen where he can log onto his Limited account.

edit: you don't need to specify any particular screensaver executable for that to work.

My last suggestion is to make yourself a Limited-class account too, and use it for your day-to-day usage, so that even if he manages to sneak onto your account while your back's turned, he's still not empowered to install software.

Hope that helps

 

[animeba]

Let's get something straight. There is no way for a standard Windows installation to prevent users from executing arbitrary code as long as the user has write access to somewhere on the hard drive. Therefore, he will always be able to "install and run" software; like winrar, for example, by simplying extracting to a folder which he has write access to.

However, you can limit his write access to various folders to prevent damage and preserve your system integrity. Creating a seperate user account with limited privileges is generally a good way to do so. This will prevent him from installing programs that need access to "Program Files" folder and "Systems" (Windows/Winnt) Folder. There are plenty of guide on the internet that will hellp you "lock down" your computer.

 

[zzzz]

You need something like Deep Freeze. Even if he installs software, it will vanish the next time you reboot. For installing permenantly, you need to supply a "thaw" it, install and then freeze again.