Can I restrict my users from installing apps?

[lkh]

How can I restrict my users from installing apps on my Citrix users? I have MF1.8 sp 2 running on NT4.0 TS sp 6. In the last month or so 2 of my users have installed (purposly? I doubt it, but maybe!) programs to a citrix server and have affected all of my other users.

Is there a good/safe way to do this??

Thanks - Leslie

 

[CitrixEngineer]

You could create essential Control Panel applets as Start Menu or Desktop items, and remove Control Panel completely from the users' profiles by editing the default profile.

You may then need to re-add Control Panel to the Administrator's profile!

I hope this helps

 

[lkh]

Unfortunately my users aren't installing from the control panel - they are clicking on something on the internet which then installs....not that I shouldn't restrict the control panel though! Thanks!

 

[CitrixEngineer]

You could be evil, like I had to be for a recent public internet kiosk setup, and stop everyone from downloading stuff by changing the security settings in Internet Explorer - or perhaps you could create a policy that only allows specified programs to be run. This is fairly tricky and requires extensive testing, but very effective.

It's worth installing some programs, like the Acrobat Reader or possibly Shockwave, into the Default profile. The trick here is to download and install the software in change user/install mode so that everybody gets it. This way, if users have a *need* for IE plug-ins, they're admin controlled. That's how we like it.

Sometimes programs automatically install themselves, like the Hotbar.com skins. In this case, the only way I could stop it was to block all access to the site at the proxy server using 3rd-party access control software. After all, the users don't need hotbar in order to do their work effectively...


Hope this helps

 

[lkh]

Would I restrict IE downloads with the IEAK? Thanks for your help!

 

[CitrixEngineer]

You could use the IEAK, or just some use some custom *.adm templates in your policy. Try these;

http://thethin.net/tsdownload.cfm

 

[gbiello]

I've seen a product called 'Appsense' that allows you to dictate exactly what a user can/cannot run. It locks down Citrix servers very well. You can check it out at

http://www.appsense.net.

 

[keigowda]

ServerLock is this product that lets you stop read/write access on any file or registry setting; and they have a free Citrix template available for download.

The template configures your server to stop a whole list of things, including adding or removing apps.