1

So, here's my conundrum.

I have about 500 pc's out in the field that aren't on a domain (yep, I know. I didn't set up the network) and I'm trying to manage them via InTune. These computers are all horribly out of date (the old SA turned off windows update and installed deep freeze) so the computers were "somewhat" safe in terms getting viruses / malware infections. (Not really, but for the sake of speeding this along and getting to the point...)

Going forward I want to remove Deep Freeze and rely on a more robust system of updates, active virus / malware removal, and patches. That said, I'm a little stuck on how to go about doing this.

The accounts on these machines are set as local administrators without any limitations on their install / uninstall rights. I am in the process of deploying intune to each of these computers.

My Question: What would be the "best" (see: most effective way) to disable end-user installs, while still being able to distribute software / updates via InTune.

Any help with this would be greatly appreciated.

2
  • Some questions which will probably need to be asked... What version are the clients? Can they be domain joined? What version servers are you running? What rights do the users need (not want) to have?
    – mrdenny
    Jul 15, 2013 at 14:35
  • All the clients are Windows 7 Professional machines. They can't be domain joined since they are at remote locations on client networks and we don't have the architecture in place (VPN servers / concentrators) to make a domain be properly supported. I basically want them to have the ability to execute already installed programs, and browse the internet and essentially nothing more.
    – A_Elric
    Jul 15, 2013 at 14:45

1 Answer 1

3

"My Question: What would be the "best" (see: most effective way) to disable end-user installs, while still being able to distribute software / updates via InTune."

Downgrade all their user accounts so that they are no longer local administrators.

As long as the user is a local administrator of the machine, they can do anything they want with that machine and there is nothing you can do to stop them.

3
  • Is there some quick way to do this en-masse or does it make more sense to do this on a per machine basis? Is this something scriptable?
    – A_Elric
    Jul 15, 2013 at 14:37
  • 1
    Removal of all users from the local Administrators group except yourself is easily scriptable via VBScript or Powershell or even batch. I know you already said no AD, but Active Directory is simply a must-have in this sort of situation. The pain you will experience as a sysadmin is boundless without AD. You could accomplish this very task in 20 minutes with a Group Policy, whereas you will likely spend days or weeks doing it without a domain.
    – Ryan Ries
    Jul 15, 2013 at 14:52
  • I am in total agreement that would be the best option, but as I stated in the comments above, these are not all in a single corporate network. These are ALL in various client networks. We also have no existing VPN infrastructure.
    – A_Elric
    Jul 15, 2013 at 15:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .