How do I deny ability to install but run programs like power user

[Dizz]

I want to deny users the access to install but allow them to run legacy programs. Currently when our users try to run programs such as Microsoft Photo editor it will not let them if they are in the users group. But when I put them in the power users group they can run all of the programs they need and have "which is different per user" but they can install some programs. How do I give them program access but not install access?

Thanks

 

[wolluf]

Is this workgroup or domain? Set up new group and give it access level between users and power users? (don't know how easy/tedious this is to do).

 

[wcburton]

I found that some programs modify settings in their own directory when they startup or have a problem if they cannot get write permission to a file in the program directory. Users do not have modify rights to anything in Program Files by default. For only those programs that needed this, I went to the subdirectory under Program Files and gave users modify rights. I would not give them modify rights to the "Program Files" folder directly.

 

[Dizz]

I will try the program files directory permissions out that sounds pretty good. Never really thought about permissions on local machine. I will let you know how that works as I tweak on it some and get it going.

Thanks!

 

[Dizz]

Ok next problem is now I do not have a security tab for the program files folder to set permissions with. Any idea were I could turn this on? Or maybe an alternate way to set the security on it?

 

[wolluf]

Are you using ntfs or fat32 filestore (security options on ntfs only)? There is a convert utility (run convert /? at a command prompt to see parameters).

 

[wcburton]

Is your file system NTFS or FAT? That may be the difference.

 

[Dizz]

You know you are right about FAT vs NTFS. I was so concentrated on the problem at hand I did not think of the obvious