How can I prevent a user from installing unwanted software?
Home > IT Answers > Security > How can I prevent a user from installing unwa...
Windows Security ATE
160 pts.
0
Q:
How can I prevent a user from installing unwanted software?
Windows Security, Group Policy
How can I restrict a user from installing any software by making a Group Policy on domain server?
ASKED: Feb 26 2008  3:59 PM GMT
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
RELATED QUESTIONS
0
Jlees
5320 pts.
0
A:
 RATE THIS ANSWER
0
Click to Vote:
  •   0
  •  0
  • AddThis Social Bookmark Button
Software restrictions allows for this scenario by restricting software that can be executed by a user-- including installers.

This can be done in two locations, but typically is done in both locations for greater security. The first location os in the computer policy, in Group policy management go to "Computer Configuration -> Windows Settings -> Security Settings -> Software restrictions Policy -> security levels" and set the policy to "Disallowed" to be enabled. (Note that you may not have that last section of Secirity levels until you right click software restrictions policy and create a software restriction policy.)

Secondly you do something similar to this in "User Configuration -> Windows Settings -> Security Settings -> Software restrictions Policy -> security levels".

Remember, User policies apply to OU's where users are stores and computer policies apply to OU's where computers are stored... there is no benefit of applying a user policy to an OU where only computers reside, unless a child OU contains users.

The hardest part of getting software restrictions right is that by default it restricts EVERYTHING from running outside of the standard OS components-- thankfully Microsoft gives us these locations and files by default when you create the policy.

There are Several ways you can allow applications to run (Or not run):

1. Via a Path
2. Via a FileName
3. Via a MD5 HASH of the file
Last Answered: Feb 26 2008  4:25 PM GMT by Jlees   5320 pts.
  •   
0
0
RSS - Discussions Help
Discuss This Answer:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _



_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Wrobinson   5610 pts.  |   Feb 29 2008  11:30PM GMT

You can use group policy to restrict user’s ability to install and run software as outlined above. For example, you can restrict access to Add/Remote programs and if I remember correctly, also use of the Microsoft Installer but if users do not have privileges to install software in the first place, such as by not being local administrators on their computers, then much of this worry is avoided. If this is not possible, then group policy can definitely be of use in accomplishing these and other tasks.

 
0