Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a problem with users downloading applications, installing, playing games, and other such unwelcome activities. Is it possible to use Windows 2003 to control the user's desktops? I've seen it done with 2008 but not sure if 2003 as the abilities as I've not been able to find the options for such controls.

Our users all use Windows XP.

share|improve this question
Are your users local administrators? If "yes", that's the beginning of your problems. You need to resolve that before you implement any other configurations. – jscott May 15 '12 at 13:24
Never though about local users or controlling in that sense. I was thinking it would probably be easier to delete ALL users locally but the Administrator and then setup AD to control the users. – Tiffany Walker May 15 '12 at 15:51
Oh goodness yes, you almost certainly want local users gone and to manage this in AD. Technically, I suppose you could set a Local Security Policy to do what you want for local users. But I'm pretty confident that is not a best-practice. – CC. May 15 '12 at 18:59
So remove ALL local based users? – Tiffany Walker May 15 '12 at 19:44
Both local and domain users can be added to a workstation's local Administrators group. You want to ensure that only users that require admin access [this should be a short list] are members. – jscott May 15 '12 at 20:09
up vote 1 down vote accepted

You can configure User and Computer settings in Windows 2003 with Group Policy and Group Preferences, just as in Windows 2008. This may solve some of your configuration issues. Going into all of the details of Group Policy and Preferences is beyond the scope of a simple answer, but Google will be your friend here. Also, each version of the Windows client increases the capability of Group Policy, so you will need to be diligent in verifying that you can accomplish what you want in Windows XP.

Group Policy alone won't necessarily solve your problems, at least not without extensive scripting. If you're having problems with programs being installed as a non-admin, you'll likely need to augment Group Policy with other tools. If the problem is people installing programs as local admins, then removing local admins permissions should be your priority before any of this work.

As for games, are you talking about online, or installed? Again, Group Policy won't necessarily solve, say, Flash games. There are other network tools to prevent that.

Depending on how much of a problem this is, you may need to step up to system management tools, such as Kace or Microsoft System Center. Again, beyond the scope of a simple answer, but this should get you started.

share|improve this answer
So control options increase based on the client's OS? Like XP will have less options then say Vista or 7? Guess what I am mostly looking for is the ability to just limit a user to running specific installed applications and internet explorer. – Tiffany Walker May 15 '12 at 15:50
That is correct. I haven't looked at XP in some time, but Group Policy should let you limit what programs run by Computer and/or User. – CC. May 15 '12 at 18:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.