how to restrict every user not to install any software

[bhaskar]

hi this is bhaskar,

i have a domain with windows server 2008 32-bit enterprise edition.my client systems are windows xp 32-bit and 64-bit.

1) i want to restrict users not to install any kind of softwares in their PC's through GPO.they can use installed softwares like skype,excel and word viewer and all other things.but they should not install anything..i want to do this through GPO

2) i want to restrict users not to download any kind of stuffs through any browser like IE,Firefox,opera,netscape,safari and all browsers.

how can i do this through GPO ? any one can guide me with step by step procedure ?

Thankx & Regards,
Bhaskar

[jeff_longley]

Your users don't have any admin rights I'm hoping?

[brad]

Hello Baskar:

This is one of those tasks in which there isn't one magic method that will accomplish everything you want but there are a number of things you can do to collectively come close to fulfilling your goal. As one user mentioned, you can strip admin rights from your user which will stop some application installations but not all. You can use a software restriction policy based on hash or registry if you have a specific application in mind. For instance, if you are finding that users are installing an application such as UltraSurf to userp your web content filtering, you can find the hash signature or the registry location for that application and create a GPO that will stop an application with that hash signature or registry location from installing. You can also create a software restriction policy based on on your zones to control installations through your IE browser through your various Internet zones. In addition, you can always hide the C drive from you users to prevent them from download installation files and saving them to their hard drive.


Brad Rudisail
Tech Support for GPanswers and PolicyPak Software