Guest XP Homie User Posted October 3, 2007 Posted October 3, 2007 I have a Windows XP Pro SP2 workstation that I would like to restrict local user accounts from software installs. I thought all that was necessary was to not give them Administrator rights. But I tested this with a user account and was able to install software. I'm thinking I need to add a local group policy but am lost as to how to do so if need be. Any help would be much appreciated. Thanks in advance. Homie
Guest Lanwench [MVP - Exchange] Posted October 3, 2007 Posted October 3, 2007 Re: Restrict Software installs on pc XP Homie User <homie@ghetto.net> wrote: > I have a Windows XP Pro SP2 workstation that I would like to restrict > local user accounts from software installs. I thought all that was > necessary was to not give them Administrator rights. But I tested > this with a user account and was able to install software. I'm > thinking I need to add a local group policy but am lost as to how to > do so if need be. Any help would be much appreciated. Thanks in > advance. Homie Are you using AD? If so, you shouldn't have any local user accounts at all other than the built-in stuff like Administrator (and make sure only you know the password). Your domain users should be users only. Most software won't install unless you have Admin or Power User rights, but some will. The place to control things like this is in your domain's group policy, not local policy. Try posting in m.p.windows.group_policy for more expert help.
Guest XP Homie User Posted October 3, 2007 Posted October 3, 2007 Re: Restrict Software installs on pc My bad. I should have mentioned this is not a domain computer. This is a stand alone machine. "Lanwench [MVP - Exchange]" <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message news:uYD68NeBIHA.748@TK2MSFTNGP04.phx.gbl... > XP Homie User <homie@ghetto.net> wrote: >> I have a Windows XP Pro SP2 workstation that I would like to restrict >> local user accounts from software installs. I thought all that was >> necessary was to not give them Administrator rights. But I tested >> this with a user account and was able to install software. I'm >> thinking I need to add a local group policy but am lost as to how to >> do so if need be. Any help would be much appreciated. Thanks in >> advance. Homie > > Are you using AD? If so, you shouldn't have any local user accounts at all > other than the built-in stuff like Administrator (and make sure only you > know the password). Your domain users should be users only. Most software > won't install unless you have Admin or Power User rights, but some will. > The place to control things like this is in your domain's group policy, > not local policy. > > Try posting in m.p.windows.group_policy for more expert help. >
Guest Lanwench [MVP - Exchange] Posted October 3, 2007 Posted October 3, 2007 Re: Restrict Software installs on pc XP Homie User <homie@ghetto.net> wrote: > My bad. I should have mentioned this is not a domain computer. This > is a stand alone machine. Ah. Sorry, that was my mistake .....it's because you mentioned "local user". You might check out Doug Knox's XP Security Console or Windows Steady State for some lockdown options. > > "Lanwench [MVP - Exchange]" > <lanwench@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in > message news:uYD68NeBIHA.748@TK2MSFTNGP04.phx.gbl... >> XP Homie User <homie@ghetto.net> wrote: >>> I have a Windows XP Pro SP2 workstation that I would like to >>> restrict local user accounts from software installs. I thought all >>> that was necessary was to not give them Administrator rights. But I >>> tested this with a user account and was able to install software. >>> I'm thinking I need to add a local group policy but am lost as to >>> how to do so if need be. Any help would be much appreciated. Thanks >>> in advance. Homie >> >> Are you using AD? If so, you shouldn't have any local user accounts >> at all other than the built-in stuff like Administrator (and make >> sure only you know the password). Your domain users should be users >> only. Most software won't install unless you have Admin or Power >> User rights, but some will. The place to control things like this is >> in your domain's group policy, not local policy. >> >> Try posting in m.p.windows.group_policy for more expert help.
Recommended Posts