Windows Server

Guest · Posted: Thu Nov 10, 2005 1:51 am Post subject: Group policy question

Hi,
a newbie question:
How can I setup a group policy that would stop the users from
installling applications on their workstations, specailly stuff that is
downloaded from Internet? Can I restrict or prohibit downloading
applications?

Thanks.

Jim Staunton · Guest

"Amnon Feiner" <none@none.com> wrote in message
news:84vcf.26035$Q27.3006@trnddc02...

Amnon Feiner · Guest

To begin with, users are not suppose to be able to run setup and install
application if their membership is "domain user " membership. Check to make
sure that they are not listed as members of the local administrative groups,
and check their domain membership. If you still have installation issues
come back here and post.
GPO is quite efficient however you could render the workstation unusable if
not properly treated.
How many station on your network?
--
A. Feiner
The Real Shrek
http://www.woodcontour.com
Solid Wood and Stone PC Peripherals

Guest · Posted: Thu Nov 10, 2005 9:50 am Post subject: Re: Group policy question

All users are members of "domain user" but they have also been given
"local administrator" access. I guess I will have to remove them from
local admin group.
There are only 5 workstations in the network.
So, you are saying I should not use GPO to restrict users' ability to
install and should only remove them from "local admin" group.

Thanks.

Amnon Feiner wrote:

Bill Vogel · Guest

Correct... No need to use GP. Follow the foc below.

This link will help you with setting up the users accounts correctly.
http://www.microsoft.com/technet/security/guidance/smb/xp2sbs.mspx
--
Thanks,
Bill V
SBS ROCKS!
http://www.oursalon2u.com
http://www.raylon.com
http://sbsbill.blogspot.com/

"ashkaan57@hotmail.com" wrote:

Guest · Posted: Fri Nov 11, 2005 9:50 pm Post subject: Re: Group policy question

Thanks Bill.
I did that and it seemed to work. The user could not install any
application. However, when he logged in to domain and attempted to run
QuickBooks (which he has to do) he received a message that he could not
do it and only a member of /<domain>/administrator or power user group
can. So, I added him to the Power User group (on local machine) but he
still had problem. I had to add him to local admin group so he could do
his job, but now I am at square one again. It seems that removing users
from local admin group stops them from doing some of the ligitimate
work as well, unless there are more settings to modify.

Thanks again.

	Windows Server Forum Index -> Small Business Server 2003	All times are GMT
Page 1 of 1