Group Policy to prevent users installing software

[maximusimo]

Hi folks,

Small Business Server 2003.

What I want to know is, is there a way, within Group Policy or something else, of preventing users from running .exe files except certain specified ones? I want to prevent them from installing unauthorised software but obviously they will still need to be able execute some .exe files like Word, Excel, etc.

All help is much appreciated, thanks in advance.

 

[Roadki11]

Take away their local administrative rights, if they are only Domain Users and have no local rights they cant install software.

 

[maximusimo]

Forgive my ignorance but would i not have to go to the machines to remove their local administrative rights?

 

[Roadki11]

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

"Another indirect benefit of using the Restricted Group setting is that it will automatically remove any local user accounts that should not be added to the Administrators group. This typically includes local user accounts that have been created by the user of the computer, to bypass domain security."

RoadKi11