Prevent Installation without Admin Rights

[Neily]

We have prevented users from running movies/audio files through media player.

However, a few users have taken to install WinAmp, by installing it to different location than the one specified. This way the get around not being able to write to the C: drive (other than their Profile folder).

This allows them to get round all our current blocks on streaming media, etc etc.

Is there a way to prevent them isntalling/running winamp (and any others should they try).

Thanks

 

[bofhrevenge2]

If you use active directory then you can ban the Winamp exe.

http://www.microsoft.com/resources/...n/Windows/2000/server/reskit/en-us/gp/207.asp

Where are they installing it too?

"Sometimes, a cigar is just a cigar." - Sigmund Freud

 

[sproot]

Can you not just remove the 'execute' permission from their profile folder?

 

[shughesPB]

I have the same problem with one user in particular that likes finding ways around OU policies. So far it’s a weekly thing to keep adding things to the disallowed list of programs he can’t run. You can block one program and he goes download a similar program to accomplish what he wants. I could simply block his downloads but he needs that function to perform his job. It has turned into a battle with him vs. me to see if I "can" stop him. The bad part is he is computer savvy and knows how everything works. Lol

I blocked windows installer but unfortunately not all programs need windows installer to install. He figured out that he can edit the registry to allow the things he wanted to do and so what do I do? I blocked his access to the registry and he downloads a freeware program that lets him edit his registry. Once I get caught up on all the things I need to do I am going to reverse my philosophy and instead of adding things he can’t run to the OU I am going to change to use the allowed programs and restrict it that way, but that will be a huge task because I don’t know everything that he has to have to perform his job. (his fault for testing me. )

I get some help with management on the problem but not enough. I will tell them that he is causing a problem with the policies they want enforced and let them know what he does but they simply say well delete the program or block it but they have yet to say something to him about his actions. In the end he is doing nothing but making it harder on himself because the more he goes around the tighter I have to go with the restrictions. He is going to end up not being able to do anything at all because if I have to I will block his Internet access to everything but the sites he needs to get to so he can download his daily files.

 

[bofhrevenge2]

Inform the user that they are in breach of the acceptable use agreement if you have one and that they can be disciplined.

Alternatively make their account a restricted user then they only have read access to the registry and system folders.

You could buy a single licence for a program like deep freeze, it's not expensive and it returns the HD to it's previouse state after each reboot.

http://www.faronics.com/html/deepfreeze.asp

"Sometimes, a cigar is just a cigar." - Sigmund Freud