Is there a setting in Group Policy to restrict client downloads?

[lesj1968]

Hi

I am a network administrator and we have approximately 20 clients all running XP Pro and Win 2000. Our server where active directory resides is on Windows 2000 version 5 service pack 4.

Is there a setting somewhere in Group Policy which can restrict a client (clients are set up as an administrator users on each client machine) from downloading or installing software on their computer, but still allow them normal administrator user access to all other aspects?

Thanks for any help and information.

Les

 

[lesj1968]

Anyone?

 

[porkchopexpress]

No there isn't i'm afraid. There are options to prevent users saving files to disk from IE but it's not really a good solution. I'm afraid that third party solutions are your only real option to prevent this if they have administrator rights.

http://www.faronics.com/html/deepfreeze.asp

 

[lesj1968]

That is what I want to do... restrict downloads from IE. They don't need to necessarily have full administrator rights on the local pc but they do need to be prevented in some way from going into the internet options security settings and changing the file download option back to enable.

Is there no way to do this using Windows?

 

[porkchopexpress]

Look here for most settings for internet explorer

User Configuration\Administrative Templates\Windows Components\Internet Explorer

You will be able to ban various tabs in the IE control panel. It's difficult to say exactly what other options you will se there as it varies by service pack.

 

[minxca]

Agree, you need third party. I think GFI has that product. Even ISA server couldn't do it (not 100%)

 

[lesj1968]

Hi

The User Configuration\Administrative Templates\Windows Components\Internet Explorer worked brilliantly restricting access to downloading files etc thank you (no need for third party s/w.

Ok how would I restrict file installations... for example from CD's or other external sources?

Thanks in advance.

Les

 

[porkchopexpress]

You can restrict access to the CD drive.

http://www.microsoft.com/resources/...n/Windows/2000/server/reskit/en-us/gp/340.asp

 

[lesj1968]

That's perfect thank you.

I am also going to set most users up as "Restricted Users" as opposed to administrator users on their local pc's. Are there going to be any draw backs using this? Naturally I will only apply this to staff that do not need to install or change settings.

Minor question: I don't suppose there is a way to automatically log users on as restricted users from the group policy...without the need to change this setting on each machine on the network?

Thanks again for all the help I've received.

 

[lesj1968]

The "Preventing access to drives from my computer" option did prevent access if the user clicks on the D: drive in My Computer or Windows Explorer. However if a CD is loaded in the drive it runs as normal and is not prevented in any way. I am going to see if it makes a difference if the user is set up as "Restricted User". Unless anyone knows a way to prevent CD's and Floppy disks from being run?

 

[minxca]

If the users is local admin, you will need third party.

You can use GPO to hide all the option under tools but your users can go to HKCU and modify it (work until the pc refresh the policy), if your user is not local admin, you can set permission on the registry.

Once they know, they only need .reg on their deskop and run it after the gpo applied.

 

[porkchopexpress]

Take a look at this link it will allow you to set which users or groups are members of the local admins group. This can cause a few problems with apps but some testing will tell you wihch ones will cause a prob.

http://www.microsoft.com/resources/...all/proddocs/en-us/sag_scerestrictgroups.mspx