While this will prevent some apps from running and/or from being
installed, it won't prevent all, especially those invoked from/through a
browser.
This setting only prevents users from running or installing programs
that are started by the Windows Explorer process. It does not prevent
users from running or installing programs that are started by the system
process or by other processes. Also, if you permit users to gain access
to the command prompt, Cmd.exe, this setting does not prevent them from
starting programs in the command window that they are not permitted to
start by using Windows Explorer.
-----Original Message-----
From: Eddie Willett [mailto:eddie.willett (at) richmond.ppdi (dot) com [email concealed]]
Sent: Friday, October 08, 2004 8:03 AM
To: 'chang zhu'; focus-ms (at) securityfocus (dot) com [email concealed]
Subject: RE: Can we really block users from installing applications
through Group policy?
One way that we do this is to not allow programs like setup.exe and
install.exe to run. This is not a perfect solution but keeps 99% of our
users from installing stuff. To enable and list the programs you don't
want
run go to User Configuration->Administrative Templates->System->Don't
allow
specified Windows applications in group policy editor. I hope this
helps.
Eddie
-----Original Message-----
From: chang zhu [mailto:cyz2000 (at) yahoo (dot) com [email concealed]]
Sent: Friday, October 08, 2004 8:46 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: Can we really block users from installing applications through
Group policy?
Hi, all
The users are not local administrators. We configure
group policy to prevent user installs but it seems
that it blocks only .msi packages. Users still can
install applications through ex. setup.exe...Can we
really block users from installing applications
through Group policy?
Any idea or thoughts on this?
Plus, if we need to block users from saving .mp3 file
on their computers, can we do it through group policy?
we are on windows2000 and XP environment.
Thanks always,
Chang
_______________________________
Do you Yahoo!?
Declare Yourself - Register online to vote today!
http://vote.yahoo.com
______________________________________________________________________
This email transmission and any documents, files or previous email
messages attached to it may contain information that is confidential or
legally privileged. If you are not the intended recipient or a person
responsible for delivering this transmission to the intended recipient,
you are hereby notified that you must not read this transmission and
that any disclosure, copying, printing, distribution or use of this
transmission is strictly prohibited. If you have received this
transmission
in error, please immediately notify the sender by telephone or return
email
and delete the original transmission and its attachments without reading
or saving in any manner.
installed, it won't prevent all, especially those invoked from/through a
browser.
This setting only prevents users from running or installing programs
that are started by the Windows Explorer process. It does not prevent
users from running or installing programs that are started by the system
process or by other processes. Also, if you permit users to gain access
to the command prompt, Cmd.exe, this setting does not prevent them from
starting programs in the command window that they are not permitted to
start by using Windows Explorer.
-----Original Message-----
From: Eddie Willett [mailto:eddie.willett (at) richmond.ppdi (dot) com [email concealed]]
Sent: Friday, October 08, 2004 8:03 AM
To: 'chang zhu'; focus-ms (at) securityfocus (dot) com [email concealed]
Subject: RE: Can we really block users from installing applications
through Group policy?
One way that we do this is to not allow programs like setup.exe and
install.exe to run. This is not a perfect solution but keeps 99% of our
users from installing stuff. To enable and list the programs you don't
want
run go to User Configuration->Administrative Templates->System->Don't
allow
specified Windows applications in group policy editor. I hope this
helps.
Eddie
-----Original Message-----
From: chang zhu [mailto:cyz2000 (at) yahoo (dot) com [email concealed]]
Sent: Friday, October 08, 2004 8:46 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: Can we really block users from installing applications through
Group policy?
Hi, all
The users are not local administrators. We configure
group policy to prevent user installs but it seems
that it blocks only .msi packages. Users still can
install applications through ex. setup.exe...Can we
really block users from installing applications
through Group policy?
Any idea or thoughts on this?
Plus, if we need to block users from saving .mp3 file
on their computers, can we do it through group policy?
we are on windows2000 and XP environment.
Thanks always,
Chang
_______________________________
Do you Yahoo!?
Declare Yourself - Register online to vote today!
http://vote.yahoo.com
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
______________________________________________________________________
This email transmission and any documents, files or previous email
messages attached to it may contain information that is confidential or
legally privileged. If you are not the intended recipient or a person
responsible for delivering this transmission to the intended recipient,
you are hereby notified that you must not read this transmission and
that any disclosure, copying, printing, distribution or use of this
transmission is strictly prohibited. If you have received this
transmission
in error, please immediately notify the sender by telephone or return
email
and delete the original transmission and its attachments without reading
or saving in any manner.
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
Email Disclaimer: http://www.co.marin.ca.us/nav/misc/EmailDisclaimer.cfm
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
[ reply ]