How can Users be stopped from installing applications

[jbeever]

How can users be stopped from installing applications on the Citrix servers even if the Windows Installer is disabled? They are using a published desktop and can install programs such as Netscape!!

Thanks

John

 

[bradx]

Are they a member of the local administrators group?

 

[jbeever]

No they are not.

 

[KCDave03]

I would think you could either implement a Terminal Services policy through AD domain or restrict their rights with the Local Security Policy

 

[marksenior]

The best way to do this requires some effort but is worth it. Create a policy (W2K Server) for a specific group of users. In the policy you can enable the option that stops users from installing anything. Plus, you can also select the option to create a selected list of executables which are then the only ones the users in this group can run. The combination of these two things will totally stop your users from installing anything.

BTW, it's really a good idea to stop Citrix users from installing programs. They will cause you lots of grief if you don't enforce some controls. Good luck.

 

[jbeever]

Thanks guys. Here's what I've tried:

In security for C:, I added the TERMINAL SERVER USER group with read/execute, read & list rights. This stops all installs!! All user profiles, document & settings, data are on a filer.