Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm wondering if this is an possible through group policy.

Is possible to define a list of allowed programs and have the rest automatically un-installed when a user logs off/on their computer?

There is an option to define policy "uninstall when software falls out of scope" but this only applies when software is originally installed through through a global policy, Something that a lot of unwanted software is not.

Windows Server 2003, Active Directory. Windows XP and Windows 7 Clients.

share|improve this question
    
So you want to uninstall everything not on a whitelist (which hopefully includes Windows, it's Service Packs and Patches)? Or would it be enough to uninstall everything you put on a blacklist? –  Hagen von Eitzen Feb 28 '13 at 10:16
add comment

1 Answer

up vote 3 down vote accepted

There is no built-in functionality in the product to do what you're looking for.

A realistic scenario would be to identify "unwanted" software and script uninstalls of the software via Group Policy Startup Scripts. You could identify the existence of the software via some "marker" that it leaves (the presence of its main .EXE, a registry entry in the "Uninstall" key in HKLM, etc) and perform an uninstall.

Uninstalling arbitrary programs is going to be problematic. Getting silent uninstalls to work is difficult enough, typically, let alone trying to execute random uninstall routines and hoping they'll "just work". I think that's a pipe-dream.

Assuming your users don't have "Administrator" rights (a best practice) you shouldn't be getting persistently-installed software onto the machine-specific areas of the computer. (Software like Google Chrome, which installs into the user profile, will always be a possibility.)

Software Restriction Policy / AppLocker may also be a viable option for you. You could "whitelist" known-wanted software and all other software would be prevented from executing. That's not an easy configuration to get right but I've seen the feature used with some success in environments where the users run a very constrained set of programs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.