|
Posted by Roger Abell [MVP] on December 13, 2005, 3:33 am
Please log in for more thread options
Sure, and in that scenario, though tedious if standalone or apps
change often, software restriction is a good solution.
For the poster however, where we must assume these are
general use machines, just ones on which user installation of
software is to be prevented, I am not so sure software restriction
policies hold the answer. If those machines are tightly configured,
to be allowed use of a well defined set of apps, things are different
and although software restriction policies could not prevent all
installs, it could make what gets installed useless.
>i use the software restriction policies with kiosks were i only allow the
>necesary application by hash or path and dissalow al the rest. It a bit
>difficult to maintain if you do many installations or if you use lot's of
>apps.
> But it works for me.
>
>>> if you want to deny installation why don't you use Software Policies.??
>>
>> If only it were that simple . . . or, if it is would you clue us in ??
>>
>> Part of the issue is that there are many installers one would have to
>> disallow with software policy, and there are installs that are only copy
>> to disk (without installers, reg entries, component registrations, etc.)
>>
>> --
>> Roger Abell
>> Microsoft MVP (Windows Server : Security)
>>
>>>> As Dave referred to the users ability to save files will be a function
>>>> of where they have the permission to write to folders which would be in
>>>> their user profile, parts of the all users profile [shared folder], and
>>>> also to subfolders of the root/drive folder that they create which can
>>>> be changed if you look at the advanced permissions of the root/drive
>>>> folder for users. By default regular users can not write to the program
>>>> files folder or \windows folder structure with the exception of
>>>> windows\temp folder where they have special permissions to write files
>>>> and subfolders. Regular users will not be able to install most
>>>> applications but not all though for XP Pro computers you can use
>>>> Software Restriction Policies to really lockdown a computer with mostly
>>>> path and hash rules as explained in the link below. --- Steve
>>>>
>>>> http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/rstrplcy.mspx
>>>>
>>>>> Is it possible to deny a group to save any data and install any
>>>>> programs on c:\ (system drive) ?
>>>>>
>>>>> Thank you,
>>>>> Sam
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
>
>
| 
XML Sitemap