2

Our organization is a bit different than most. During certain times of the year, we grow to thousands of employees, and during off-times, less than a hundred. Over the course of a few years, many thousands of people have come and gone in our offices, and left their legacy behind in the form of all sorts of unwanted, unapproved, (and sometimes unlicensed) software installs on our desktops.

We are currently installing redundant domain controllers and upgrading current servers, all running Windows Server 2008 Enterprise, and will eventually be able to run a pure 2008 DC network. With that in mind, what are our options in being able to lock down users, such that they cannot install unauthorized software on systems without the assistance (or authorization) of the IT group?

We need to support approximately 400 desktops, so automation is key. I've taken note of the Software Restrictions we can implement via Group Policy, but that implies that we already know what users will be installing and attempting to run... not quite so elegant.

Any ideas?

Improve this question
6
  • 4
    Can you just not make them administrators on the local machine? If they are not an administrator the can't do much to the computer.
    – Zoredache
    Jun 2, 2010 at 22:38
  • All of our users login with domain accounts. Nobody has a local administrator rights on any machine. Since seating is rarely assigned (majority of users are in call centers), setting up local users for every possible employee on every possible machine gives me a headache just thinking about it. Is there a way to automatically create a restricted local user account for these folks at login via Group Policy?
    – Cypher
    Jun 2, 2010 at 23:01
  • Can you give some examples of the software they're managing to install, despite having no administrator rights on the machine?
    – Chris Thorpe
    Jun 3, 2010 at 0:00
  • AIM, Yahoo IM, Skype, various browser toolbars, vendor-specific phone-related software, alternate web browsers, itunes, winamp, utorrent, limewire, conficker.b, open office... etc.
    – Cypher
    Jun 3, 2010 at 0:14
  • 1
    That's not the same as no local administrator rights. On a workstation, right-click 'My Computer' and select 'Manage'. Then go to Users & Groups and find the 'Administrators' group. Every directory group and user in there has local administrative rights, which gives them carte blance. If your users have this, you must work to identify WHY, and remove the right.
    – Chris Thorpe
    Jun 3, 2010 at 8:17

6 Answers 6

Reset to default
2

If you're talking about laptops or desktops that are checked out/assigned to people, then simply do not give them administrator access. This will still allow them to install programs (Assuming they were written properly) to their home folder, and then when they leave, you need only delete their profile/user account to remove any programs they installed / changes they made. This will also limit the damage that a virus can do - simply quarantine & clean their documents on any system which they have not logged into, delete & recreate their account, restore their cleaned documents. Virus gone.

It's quite hard to actually create a "white list" of approved executables based on the fact that executable code need not even have a name, simply reside in memory on a page marked as executable. Your best bet is to simply make it easier for you to remove the unwanted applications when the user leaves.

If this is a security issue and not a "cleanup" issue, how did they get the programs onto the system in the first place?

Improve this answer
3
  • It's less of a security issue and more of a stability issue. Too many people are installing junkware applications that bog down their system, prevent them from working, and eat up network resources. This is less about cleaning up after people leave, and more about keeping people from doing things such as unleashing the conficker worm on our network, streaming music from the web and eating up bandwidth, and so on.
    – Cypher
    Jun 2, 2010 at 23:33
  • This is definitely your solution. If you make sure that the users are simply a member of the domain users group and that domain users is not a member of local admins on the workstations, they will not be able to install anything. You can also use GPO's to further restrict things on the workstations to enforce a common look and feel too.
    – BoxerBucks
    Jun 3, 2010 at 1:44
  • As a bonus, you can also use GPOs to only "allow" certain executables to run. You'll have to test, but you can start from a completely locked down envronment where even "explorer" will not run. You can then specifically approve certain applications to run - word, excel, ppt etc. But as a "normal" user, they shouldn't be able to install anything anyway ...
    – Tubs
    Jun 3, 2010 at 7:53
1

If you have a good network infrastructure and redirect certain folders (and train users to use home directories), you can get a product like Deep Freeze (I think Microsoft has a similar free product available too) so you can set up the machine to your company's preferred configuration then "freeze" it, so on reboot the computer goes back to the original state you set it up to. If they install something (or it gets infected with a virus), rebooting puts it into a pristine state again. They can still install stuff but it's a hassle to do it every day.

Of course, you can limit their access levels so if they're not power users or admins they can't install most programs. But this still won't limit their creativity from finding ways around your blocks.

Make sure you have your policies well spelled out. Make it a fireable offense if need be (I don't know your company policies or how serious you're taking this). Make it spelled out that the computers are company, not private, property and they should not expect privacy. Then install remote desktop software (VNC, remote assistance, etc.) and spell out that if necessary IT can remotely monitor activity. You need these things spelled out so it's clear what can and cannot be expected as an employee. How draconian you want your rules to be are up to you and HR.

You can also consider making images of your systems and then periodically re-image your computers to a pristine state. Pain in the butt to keep up with Windows Updates, though.

Improve this answer
2
  • I've thought about doing this, but we have far too many different variants of desktops to keep track of. Our executive staff tend to make decisions on a whim, and we'll end up with four new desktops here, a dozen new desktops there... managing images for each of those types of machines would become painful. We also do not yet have the network storage capability to move everyone to network shares. This may be a possibility down the line, however.
    – Cypher
    Jun 2, 2010 at 22:58
  • 1
    There is no way to do what you're looking to do without having enough control to say what gets on the systems and what doesn't, and that means across the board configurations for the OS, baseline applications, etc. If non-techs decide what happens on a whim and your tech job is to simply "make it happen" and patch things together to keep it running, then it's going to be a chaotic mess. The answer to your problems means policies that let IT manage IT resources.
    – Bart Silverstrim
    Jun 3, 2010 at 1:46
1

Make sure the domain users aren't administrators or super users on the local desktops. They should not be able to install stuff like Skype or phone suites if the aren't. Double-check.

Get a modern deployment suite going, like the free Microsoft WDS or perhaps even go for System Center Configuration Manager. The images used here are hardware-independent as long as drivers exists it will work on a plethora of different hardware. With Configuraiton Manager you can then automatically deploy the applications they need as well. When this is automated, it should be quick and painless to simply wipe and reload a desktop if needed.

Further tweaking would be a bonus, but could involve GPO lockdown of IE to prevent user toolbars and so on BUT any toolbar installed by a user would only be active for that user. So simply do not re-use user accounts.

Improve this answer
1

Although you can prevent a lot of problems through the use of restricted accounts that will not solve all your problems. Just ask anyone who does IT in a school. :(

In addition to the use of restricted accounts you should use mandatory profiles, as that also helps to reduce some of the problems users can cause.

You might also consider imaging the machines and restoring the machines when appropriate. There are a number of ways machine images can be restored (semi-)automatically, so that the number of machines really isn't all that much of a problem. I'm sure there are others here who can provide the specifics.

Improve this answer
0

Something like DeepFreeze is a sure-fire way. Not sure how much management goes into something like that though. There's other ways - the simplest and most hands-off is to not make them local admins, as Zoredache mentioned. They can install somethings but not much, that way.

Improve this answer
2
  • DeepFreeze user here-it's great on kiosk-like systems and workstations that aren't meant to be personalized. For management you use a central monitor program that can monitor which frozen machines are on, you can thaw them remotely, get some statistics (MAC, ip, etc.) and remotely update their configurations (like setting up a set of times to shut them down, put them in a "maintenance mode" where they'll run Windows Updates while locking the keyboard and mouse). It's great for schools and libraries.
    – Bart Silverstrim
    Sep 22, 2010 at 10:14
  • It also lets you recover easily from a worm infestation on the network. Just reboot. Gone. As long as all the other infected systems are cleaned that aren't DF'd. It's cathartic to delete the Windows directory, even if it is only until the next reboot.
    – Bart Silverstrim
    Sep 22, 2010 at 10:16
0

The Microsoft version is called Windows SteadyState. XP or Vista only though - there are no plans to support it on Windows 7.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .