I've different OUs for different Departments. For Example Mechanical OU and Programmers OU. I don't want to block the users entirely from installing and Uninstalling software. For example users of mechanical OU should be able to install CAD software(such as AutoCAD, SolidWorks) Programmers shouldn't be able to install those softwares on their system. Programmers should only be able to install and uninstall software that they need and vice versa. How can I achieve that?

  • 2
    Why not just deploy everything each person needs up-front? Saves everyone time and hassle.
    – womble
    Aug 14 '18 at 9:59
  • if something goes wrong with the installed software. I want the user to be able to reinstall.
    – surjit
    Aug 14 '18 at 10:02

I'd look at using Applocker policies deployed from AD GPO. It's the technology progression of Software Restriction Policies and has some good features for application whitelisting/blacklisting. Check here for the MS guide on how to configure it:


The info says it applies to Windows 10 but Applocker policies can be deployed to Windows 7 & up. Hope that helps.




Use Software Restriction Policies in GPO. Set default Security Level to Unrestricted. Under Additional Rules set a path rule using a wildcard file path (eg. *autocad* or *solidworks*) and set the individual security level to Disallowed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.