How do you prevent installs on NT4/Citrix?

[jespino]

I need to prevent users from installing on Citrix/nt4 terminal services. I looked into policies but couldn't find a way. I only found a registry setting that would request admin credentials on network installs and media installs. This is good but if the installation program is in the user's directory then this solution wouldn't work. The user would still be able to run the install. i hope someone will be able to help. Thanks.

 

[ShackDaddy]

Create a locked down profile and then assign it to all your non-admin users. I don't even give mine access to the control panel or desktop icons. Without access to the RUN command or the directory hierarchy, nothing can be installed. I pretty much took away anything that could load a file, including PAINT.

On the other hand, if you are using Term/Citrix services to give access to the Office Suite and so forth, you would want to limit some of your restrictions. One thing you can do on the client is tell it to load a program on login. This effectively makes whatever program you specify the shell, rather than 'explorer.exe'. I've used this to lock things down. Did you know that Outlook makes a rather handy shell in itself?

ShackDaddy

 

[jespino]

Thanks for the tip!! I will look into this option. Is there also any security policies(templates) that can be used?