A very easy way to stop users from installing software is to install
Deepfreeze. It basically locks the hard drive down so that if users do
install software or make changes to the system, they are reset the next time
the computer reboots. I have found this to MUCH more effective than any
Windows policy restriction. I even let users log in as local administrators
so that I don't have to deal with software incompatibilities with
permissions. If they hose their system up or get a virus, it is deleted the
next time they reboot their system.
-Jesse Weigert
-----Original Message-----
From: chang zhu [mailto:cyz2000@yahoo.com]
Sent: Friday, October 08, 2004 5:46 AM
To: focus-ms@securityfocus.com
Subject: Can we really block users from installing applications through
Group policy?
Hi, all
The users are not local administrators. We configure group policy to
prevent user installs but it seems that it blocks only .msi packages. Users
still can install applications through ex. setup.exe...Can we really block
users from installing applications through Group policy?
Any idea or thoughts on this?
Plus, if we need to block users from saving .mp3 file on their computers,
can we do it through group policy?
we are on windows2000 and XP environment.
Thanks always,
Chang
_______________________________
Do you Yahoo!?
Declare Yourself - Register online to vote today!
http://vote.yahoo.com
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
