Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I apologize in advanced for anything that is no technically correct in the following. I am a beginner with server technology, and have only had about less than a month's experience with it.

Is there any way to block roles and features from being added to a Windows 2008 or a Windows 2012 server? I've been tasked with creating an IIS server and ensuring that only IIS can run, by using AppLocker. I've used AppLocker to block most executables (except those still required), but since I want to keep Server Manager, it is still ossible to add more roles and features. Is there anyway to disable this?

Thank you for any help, and once again, sorry something is technically incorrect, I will clarify if needed, and if I can.

share|improve this question
This is where restricted admins, policies, change control, etc. come into play. –  TheCleaner May 10 '13 at 13:40

1 Answer 1

There might be one at the Group Policy Editor

You don't want to disable the functionality altogether rather you want people to NOT be able to add features and roles.

Configure your user groups and your users accordingly . I suggest having a look at the [Security Configuration Wizard] and then lusrmgr.msc if you don't have an AD(http://technet.microsoft.com/en-us/library/cc771492(v=ws.10).aspx)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.