User Account Config

[mdahc]

Can someone tell me how to set up an XP Pro admin account (if it can be done) so that a user cannot add/remove programs whereas preinstalled programs (i.e. Command AntiVirus) are allowed to update themselves? Is this some sort of registry setting? Also, short of a domain controller, can you force the installation of critical updates through Automatic Updates?

 

[Promethply]

In WinXP Pro, the Admin account already exist by default, but you want to set its password through these steps in windows:

Control Panel-->Administrative Tools-->Computer Management-->Local Users and Groups-->Users-->right click Administrator, set password.

As long as you give your user only a 'user' level priviledge, he would not be able to install or remove any program.

Only Admins can change the update setting for both Windows and AntiVirus, and critical updates for Windows and AntiVirus applications will install automatically once you enable automatic live update.

 

[KB]

You can't force automatic updates, but you can set Automatic Updates to automatically download and install themselves. The configuration is in the "MY Computer" properties dialog.



You can block the Add/Remove program applet in the control panel using group policy:



Prevents users from using Add or Remove Programs.

This setting removes Add or Remove Programs from Control Panel and removes the Add or Remove Programs item from menus.

Add or Remove Programs lets users install, uninstall, repair, add, and remove features and components of Windows 2000 Professional and a wide variety of Windows programs. Programs published or assigned to the user appear in Add or Remove Programs.

If you disable this setting or do not configure it, Add or Remove Programs is available to all users.

When enabled, this setting takes precedence over the other settings in this folder.

This setting does not prevent users from using other tools and methods to install or uninstall programs.

 

[mdahc]

Thanks. Yeah, I've been looking at the Group Policy MMC, and I noticed that Add/Remove Program policy. Also, if I configure the "Run only allowed windows applications" policy under User Configuration->System for, say, a user account with admin privileges, then he/she will not be able to execute any programs that I haven't specified, correct (even if that person installs a program I didn't specify)? In addition, does altering a user (with admin privileges)'s policies effectively negate admin privileges (i.e. the ability to allow Anti-Virus and Critical Updates to install)?

One last thing, I thought setting Automatic Updates in the Security Center (forgot to mention the machine will be running XP Pro SP2) only downloads the updates and then makes the yellow shield appear in the system tray. Doesn't the user have to manually confirm the installation of the updates?