a12

I have a 5 Windows XP Pro SP2 workstations in SBS2003 domain (for
example:MyDomain.com).
For 2 worskstations in domain I would like to restrict local user
accounts from software installs. I'm thinking I need to add a local
group policy but I am not to how to do. I thought all that was necessary
was to not give them Administrator rights.
Any help would be much appreciated.

Thanks,

Shenan Stanley

a12 wrote:
> I have a 5 Windows XP Pro SP2 workstations in SBS2003 domain (for
> example:MyDomain.com).
> For 2 worskstations in domain I would like to restrict local user
> accounts from software installs. I'm thinking I need to add a local
> group policy but I am not to how to do. I thought all that was
> necessary was to not give them Administrator rights.
> Any help would be much appreciated.

You could prevent certain software executables/hashes from running at all
(through group policies/software restrictions) - but if you have taken away
administrative rights - they are really only able to install software that
affects their user profiles anyway. They cannot write to the HKLM and most
system directories (given default NTFS permissions and such) as a normal
user on a WIndows XP system.

Portable apps - it's where regular users who want to run something *can* run
something even if you have limited them on the system. heh

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html