Users are able to install programs on 2003 domain 2

[kulakat]

I have installed a windows server operating system and applied a gpo to a group of users which greatly restricts them.(ie no control panel no run command etc.)However i must have done something wrong as all these users are able to install programs. I thought by default users are restricted this ability. But I cannot see why they are able to do this.

I have disabled the gpo and this makes no difference to their ability to install progs. When gpo enabled all gpo restrictions seem ok.
Any ideas on what i should be looking for?

 

[Larsdemo]

Software restriction policy

Lars

Network admin for worldwide freight forwarders company.
mcp mcsa\: Messaging mcse -2003

 

[kulakat]

Yes, I have heard of this but I did not think i needed to set this up as users are not supposed to be able to install by default.
I was hoping for an answer that might shed some light on why users can install??
I.e maybe i've given them rights somehow but don't realise etc..

Could I deny them admin rights ??
would that be an option.

 

[NortonES2]

Are you saying that you've given all users admin rights? If so then that is why they can install apps amongst other things. End users should never have admin rights to the domain, we don't even give them local admin rights to their PC's.

-------------------------------

If it doesn't leak oil it must be empty!!

 

[kulakat]

Of course i haven't - i don't know why they have ability to install stuff - thats why I'm asking the question.

 

[Airsport]

Group Policy - Windows Components
Windows Installer
* 'Always install with elevated privileges' will ensure that programs will install properly without you having to logon as administrator. I have seen administrators placing users in powerful administrative groups, just because they did not know about this elevated privilege setting.
Trap: 'Elevated privileges' must also be enabled in the Computer Configuration for it to be effective.

 

[mastersmurf]

It sounds like they have either admin privs to the domain or at least admin privs to their local pc. - Are you sure these guys dont know the admin pwd you are using or at least someone who does ?

Someone could have made them admin/power user etc on their local machine

 

[porkchopexpress]

The users either have admin rights or power user rights on the local station. Power users have write access to the Program Files directory and some areas of the Windows directory, this allows them to install some applications.

You can use the restricted groups feature to remove any accounts from the local admins group and keep it that way.

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

 

[kulakat]

It was admin rights on local pcs...
Domain users were part of administrators

Thx for all replies
I thought it would be a simple one but just couldn't locate it. Was having a bad day...