Restricting Software Installation

[aimo3]

Is there a way to restrict a user in the administrators group from installing software in Win 7?

I have some laptop users installing all kind of toolbars and download applications, and infecting their systems with malware, but still need them to be administrators in order to change IP or guide them over the phone in diagnosing errors

 

[Joe C]

There is a place in the Control Panel|Internet Options|Internet|Custom box where you can disable file downloads and other settings

 

[aimo3]

Everyone's work requires downloading of one sort or another. I just need to restrict software installation.

 

[aimo3]

I found there is this policy, GP > Computer Configuration > Administrative Templates > Windows Components > Disables Windows Installer.

But in the Help it says "This setting affects Windows Installer only. It does not prevent users from using other methods to install and upgrade programs."

I tried and installed a program

Any other idea, pros?

 

[Nukem]

Make them all user account.

YOU as the administrator, give them the programs they need to deploy with.

You accumulate all the files/programs they need and host on a secure network; then when they need to D/L something they get it from you... not a 3rd party.

Then train your people on what not to do.

Very basic terms I know, but you get the idea...

 

[WackWack]

I agree with Nukem. Even in a smaller work environment, it is important to have control over what is being installed.

This becomes even more crucial if there are network shares being utilized. Going through the group policies and trying to limit what users have access to do/not do whilst these users still have administrator privileges is going to do nothing more than cause headaches for you, and in the end probably isn't going to solve the problem.

Inconvenience for the end user is far easier to fix than a compromised infrastructure...

 

[luke127]

WackWack is right. personally I'd just whitelist the programs and files they need. Disable any installing altogether by not giving them administrative privs, and then modifying the whitelist whenever needed.