IIRC, the OP's clients are XP (I seem to remember Win2k as well, but I am
programed to ignore that ;)

SAFER restrictions are what you want. I've meant to write up a "how-to" on
that (as I cover it in my Blackhat training) but I just can't find the the
time to do so... Deb Shinder (The wife of Tom, the dude that own's
ISAserver.org) has gone out of her way to provide the following edu--

http://www.microsoft.com/technet/security/prodtech/winclnt/secwinxp/xpsg
ch06.mspx

hth

t

----- Original Message -----
From: "Miroslaw Slawek Chorazy" <mchorazy (at) depaul (dot) edu [email concealed]>
To: <focus-ms (at) securityfocus (dot) com [email concealed]>; <cyz2000 (at) yahoo (dot) com [email concealed]>
Sent: Friday, October 08, 2004 9:51 AM
Subject: Re: Can we really block users from installing applicationsthrough
Group policy?

> Blocking users from installing applications is really a comprehensive
> group of related policies not limited to just Group Policy Objects.
>
> Some of them are;
> 1. User rights on the local computer
> 2. ACLs on Directory Sturctures
> 3. ACLS on Registry Hives ( especifically HKLM and HKCR )
> 4. Software Restriction Policies or simmilar blocking mechanism
>
> Slawek
>
>>>> chang zhu <cyz2000 (at) yahoo (dot) com [email concealed]> 10/8/2004 07:45 >>>
> Hi, all
>
> The users are not local administrators. We configure
> group policy to prevent user installs but it seems
> that it blocks only .msi packages. Users still can
> install applications through ex. setup.exe...Can we
> really block users from installing applications
> through Group policy?
>
> Any idea or thoughts on this?
>
> Plus, if we need to block users from saving .mp3 file
> on their computers, can we do it through group policy?
>
> we are on windows2000 and XP environment.
>
> Thanks always,
>
> Chang
>
>
>
>
>
>
> _______________________________
> Do you Yahoo!?
> Declare Yourself - Register online to vote today!
> http://vote.yahoo.com
>
> ------------------------------------------------------------------------
---
> ------------------------------------------------------------------------
---
>
>
>
> ------------------------------------------------------------------------
---
> ------------------------------------------------------------------------
---
>
>
>

------------------------------------------------------------------------
---
------------------------------------------------------------------------
---

[ reply ]