Windows Installer

[ccook]

Whats the best/easiest way to "lockdown" a pc so that the average Joe/Jane non-Admin cannot install software? I've read about a registry edits (which I can handle) and the group policy editor (which I've never used). Any guidance from on high? <img src=/S/confused.gif border=0 alt=confused width=15 height=20>

[Leif]

There are many registry tweaks to help lock down a pc - see JSI Tip # 0050 and its associated links for some idea of what can be done.

Possibly the simplest would be to remove access to the Control Panel (Incl. add/remove programs), inhibit the autostart for CD's and remove Run from the Start menu.

[JoeP517]

What kind of privileges do they need? You could put them into the user group. A user can not install software. You should assign a strong password to the local administrator account also.

Joe

[ccook]

Good question. Let me try to be more specific. I do not want users to be able to install software to their pcs without my doing so. No webshots, messenger programs, spyware, etc.

That said, I gather that somehow you can allow Windows Installer to install components of Office 2000 or other specified programs without having full access to the installer functions. If I could fine tune this function it would be helpful, but I'm willing to take the big club approach if necessary.

Cliff

[JoeP517]

To do all this you'll have to be logged in as an administrator. Right click on My Computer. Select Manage. Open 'Local Users and Groups'. Click on Groups. Double click on users. Add the userid to the user group. Members of the user group can not install most software on a Win2k machine. Click OK. Click on Users. Double click on the userid. Click on the Member Of tab. Make sure User is the only group. Assign a strong password to the local machine Administrator. If that is not sufficient you'll need to investigate group policies. Use Windows Explorer later as needed to manipulate the Start menu.

Joe