Group Policies

RussS

Hey guys

I have a problem I need assistance with. I want to restrict users on XP machines from installing software by using group policies. The reason I wish to do it this way rather than just making the user account a restricted one is that they are on a mixed network and have autoadminlogon for Novell.

Any templates or ideas are greatly appreciated.


Russ

garv221

In this in a Domain or Local? Either way the User account is what you want, and deny access to any hard disks. Gpedit. msc or active directories....Do this in Admistrative templates - then windows explorer. Good Luck!

RussS

Sorry - this is local.

If we make them just a user on the local machine the Novell autoadmin puts you straight into the machine without being able to logon as administrator. The only way to get in is to break the novell login and then you are given the opportunity to log on as another user. In this school site there is a need for the tutors to be able to install software on the lab machines, but we do not want the students to be able to do this.
Unfortunately this is a site we manage, but is not fully managed by us and the 'site admin' has some set ideas about things.

garv221

In the mmc you can deny access to install software. But with this being local you still are going to apply this to a specific user only.
http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx

RussS

Cheers dood.

We are rather understaffed at the moment and have to find a solution and institute it while the clients students are having a break. I spent a couple hours looking, but missed that ... awesome

garv221

Are you trying to create an access list of software restrictions within the local computer policy of a certain number of known users?

RussS

Basically what we want to do is to use group policy on local machines to prohibit the loading of software. This is for 2 reasons .. messenger programs and spyware.
If we make the students local users we have a problem with the autoadminlogin putting us straight into the machine as restricted instead of admin. We thought using policy would help us get around this until the christmas break when we are going to install a properly constructed range of user profiles with ZENworks.

garv221

Yes, that can all be done with Local Policy. Good Luck!

matchey

Russ, are you running zenworks on your netware server?, an excellent tool for locking down workstations etc Have just finished work on locking down 200 xp pc's which has also included setting them up to auto update from a sus server for patches etc.

RussS

Hey matchey

zenworks will be set up on this network over the christmas break - I was just looking for a temp solution to hold us until then. A friend wrote a policy script for us that blocked the running of assorted messengers and also stopped install of any programs without a password.
The problem for us is that all users when logged on with the Novell script are Administrators An inherited issue that we will rectify soon