How to Deny Domain user Install Software in workstation

mean_pc

How to Deny Domain user Install Software in workstation?? Please help me

Find more posts tagged with

SAVE $250 on Your Microsoft Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View Microsoft Boot Camps

Comments

eurotrash

Try a software restriction policy (hash rule).

mean_pc

software restriction policy only is restrict software, I want deny domain user install

eurotrash

It should work anyway. After all the exe or msi or whathaveyou is an app, so just create a hash rule for the file to prevent it from running, and no one will be able to open the file and thus will be prevented from installing it.

RTmarc

Group Policy should take care of that if deployed correctly. Deny them administrative rights and they should not be able to install anything. The hash rule will only work for one application at a time. If you want to block them from being able to install just about everything, group policy is the way to do it. Of course it will not block them from being able to install applications that do not modify the registry but you could use the hash rules for that.[/i]

TMM3

How about granting a 'User' the right to install progs? I have not been able to find that in GP. Any ideas?

rockstar81

TMM3 wrote:

How about granting a 'User' the right to install progs? I have not been able to find that in GP. Any ideas?

A user unless restricted should be able to install sw onto a workstation by default. You could however deploy a set amount of sw through GP and allow them to install it by going into add/remove programs and slecting item to install.

mean_pc

I don't know how to do

agustinchernitsky

First make sure they don't have admin rights on the workstation...

Is it a specific software?

Danman32

I am sure you could disable the MS Installer for the user, which would disable the ability to install the majority of apps. However if you allow a user to run any application he wants, rather than a specific list, , if an app used its own installer, there would not be any way of distinguishing that app that happens to be an installer from any other app and inhibit it.

w^rl0rd

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_wininstall_group_policy_computers.mspx?mfr=true