I'm running a public library with PCs available for people to use. I'm setting up the next upgrade for the PCs, which will be running Windows 7. We use Deepfreeze to maintain the PC's state (a brief flirtation with VHDs showed that VHD wasn't really suitable), and something called Netloan to track bookings and kick users off when their time expires.
Ideally we would like users to be able to install software on the PCs. We're constantly fielding complaints about those USB flash drives that want to install drivers, various games, utilities and other stuff that people want to use.
However, we don't want to give people access to the entire filesystem, nor do we want them to be able to uninstall Netloan (which would allow them to exceed their booking time.)
Other than that, hopefully Deepfreeze and our firewall should be able to stop any other types of abuses. We don't even care if users can't uninstall software - Deepfreeze should take care of that when their session ends.
So is there any way of allowing non-admin users to install software on Windows 7? Maybe with local GPOs of some sort?
(I guess a scarier alternative is to somehow give the public account admin rights but limit it in some way so they can't uninstall software, kill processes, edit GPOs, access protected folders etc. But that sounds quite complicated.)