1

Problem:

We have a site where there is a mix of Windows 2000 and Windows XP machines. These currently have user accounts with Admin Rights which can install licensed/unlicensed software. We want to restrict such activities so that,

  1. Users can install / uninstall pre-approved list of software.
  2. Users are given unrestricted access to all other system resources (All Admin rights apart from software installation).

I am looking for a way to achieve this using any MS or third-party tools. All suggestions are welcome.

Edit: Given these challenges, what would be the recommendations?

Improve this question
1
  • So, you trust the user to take the car for a drive but not to change the tires? :)
    – romandas
    Jul 9, 2009 at 18:48

3 Answers 3

Reset to default
2

If you really NEED to do this (...), you'd want to research about Window's Software Restriction Policies: http://technet.microsoft.com/en-us/library/bb457006.aspx

[start rant]
To tell you the truth though, it looks like a LOT of work for something that IMO seems to be particularly easy to circunvent since the users will at the end (as you pointed) have unrestricted access.
[end rant]

Anyways, here's some info from that link:

Software restriction policies are a part of Microsoft's security and management strategy to assist enterprises in increasing the reliability, integrity, and manageability of their computers. Software restriction policies are one of many new management features in Windows XP and Windows Server 2003.

This article provides an in-depth look at how software restriction policies can be used to:

  • Fight viruses
  • Regulate which ActiveX controls can be downloaded
  • Run only digitally signed scripts
  • Enforce that only approved software is installed on system computers
  • Lockdown a machine
Improve this answer
3
  • It's anot alot of work and a lot more restrictive than you think- especially if you remove cmd.exe and mmc.exe. In addition access to resources is not equal to ability to install apps.
    – Jim B
    Jul 9, 2009 at 18:43
  • Yeah, the hard part (I think) it's going to be the actual "balance of privileges" as he wants to keep his users to have somewhat of an 'unrestricted access' on the workstation.
    – l0c0b0x
    Jul 9, 2009 at 18:45
  • Um, if you remove cmd.exe, you can just copy it back in. They'll have network access, right? And the ability to use removable media?
    – romandas
    Jul 9, 2009 at 18:52
0

Users can install / uninstall pre-approved list of software.

I think Windows has "Software Restriction Policies" or something, in Group Policies.

Users are given unrestricted access to all other system resources (All Admin rights apart from software installation).

That is only 10 minutes away from being able to install any software. (In fact, for a big part of all the software available, you don't need to install anything - just unzip and double-click on the .exe)

Trying to restrict an Administrator is a very bad idea.

Improve this answer
0

Use SRP. Use the hashtags option to allow only the software that you want them to be able to install and run. I would also consider dropping them out of administrators and insead putting the accounts in power users. On the folks that don't want to be dropped out of the admin group I'd be especially careful as to what they are allowed to run.

Improve this answer

You must log in to answer this question.