+ Post New Thread
Page 1 of 4 1234 LastLast
Results 1 to 15 of 48
How do you do....it? Thread, Restrict Kids from Installing ANYTHING in Technical; Hi All, Just wondered how (if you do) restrict the little bliters from installing anything on the PC's? We already ...
  1. #1
    ICTNUT's Avatar
    Join Date
    Jul 2005
    Location
    Hereford
    Posts
    1,419
    Thank Post
    196
    Thanked 249 Times in 122 Posts
    Rep Power
    62

    Restrict Kids from Installing ANYTHING

    Hi All,

    Just wondered how (if you do) restrict the little bliters from installing anything on the PC's?

    We already restrict anything from being downloaded of the web but we have had a small group of kids bringing stuff in on Pen Drives and installing from there.

    Any pointers would be apreciated.

  2. #2

    Join Date
    Sep 2005
    Posts
    22
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Restrict Kids from Installing ANYTHING

    you could use group policy to restrict all applications except the ones you specify from running.

    you could also use the prevent installers from removable media to also help.


    Alan

  3. #3
    ICTNUT's Avatar
    Join Date
    Jul 2005
    Location
    Hereford
    Posts
    1,419
    Thank Post
    196
    Thanked 249 Times in 122 Posts
    Rep Power
    62

    Re: Restrict Kids from Installing ANYTHING

    Using software restriction policies is the way to go but due to the number of legitimate programs installed it would take some time to work out and test the policies to ensure that other programs are "Not Blocked".

    What I am after is just a way to stop them installing anything at all as a quick fix untill I can fully test the software policies

  4. #4

    Dos_Box's Avatar
    Join Date
    Jun 2005
    Location
    Preston, Lancashire
    Posts
    9,823
    Thank Post
    580
    Thanked 2,161 Times in 986 Posts
    Blog Entries
    23
    Rep Power
    627

    Re: Restrict Kids from Installing ANYTHING

    Just prevent them using the Windows installer and disallow any install media in GPOs'. There are plenty of options in AD to prevent any kind of software installation.

  5. #5

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Restrict Kids from Installing ANYTHING

    Disable the USB.

  6. #6

    Dos_Box's Avatar
    Join Date
    Jun 2005
    Location
    Preston, Lancashire
    Posts
    9,823
    Thank Post
    580
    Thanked 2,161 Times in 986 Posts
    Blog Entries
    23
    Rep Power
    627

    Re: Restrict Kids from Installing ANYTHING

    Disable the users.

  7. #7

    mac_shinobi's Avatar
    Join Date
    Aug 2005
    Posts
    9,700
    Thank Post
    3,230
    Thanked 1,040 Times in 962 Posts
    Rep Power
    363

    Re: Restrict Kids from Installing ANYTHING

    I agree with geoff with regards to stopping the ppl using usb pens and such like to install things off of them @ disable usb.

    With regards to using the gpo to only allow software you have on there, all they would have to do to get around that is rename the setup file(s) to something that is allowed to run on the machine like winword or calc etc.

    Not sure if this is feasable option but deep freeze is used quite a lot from what I have heard and that is pretty good

  8. #8

    GrumbleDook's Avatar
    Join Date
    Jul 2005
    Location
    Gosport, Hampshire
    Posts
    9,928
    Thank Post
    1,337
    Thanked 1,778 Times in 1,103 Posts
    Blog Entries
    19
    Rep Power
    594

    Re: Restrict Kids from Installing ANYTHING

    If you are XP and Server 2003 only then you have the option of Software Restriction Policies.

    These will allow you to take a snapshot of applications that are allowed to run (and associated files / .dlls) and use only these.

    http://www.microsoft.com/technet/pro...eafcfd86c.mspx

    I have only seen this in action properly once .. in a business that only ran Office and 3 other apps ... I have never heard of a school with it fully implemented ... but theoretically it is possible.

    And thank you for reminding me about the changing of name of apps Shane ... that use to be a right pain in the ar$e when you lot did that on the W9x machines.

  9. #9

    russdev's Avatar
    Join Date
    Jun 2005
    Location
    Leicestershire
    Posts
    6,918
    Thank Post
    708
    Thanked 550 Times in 365 Posts
    Blog Entries
    3
    Rep Power
    204

    Re: Restrict Kids from Installing ANYTHING

    we do by fact that we run rm here...

    what they have done is allowed programs to run from program files with out a problem but students cant access program files dir etc...

    then also if want to run exe outside of that addem to list of allowed files and paths..

    russ

  10. #10
    mark's Avatar
    Join Date
    Jun 2005
    Posts
    3,958
    Thank Post
    248
    Thanked 49 Times in 45 Posts
    Blog Entries
    2
    Rep Power
    46

    Re: Restrict Kids from Installing ANYTHING

    We bought appsense application manager which dissalows programs across a site - hefty price tag tho' - about £2k.

  11. #11

    Join Date
    Sep 2005
    Posts
    22
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Re: Restrict Kids from Installing ANYTHING

    to disable usb and removable media in windows xp.

    http://support.microsoft.com/default...b;en-us;823732
    http://support.microsoft.com/default...b;en-us;555324

    this should hopefully help. i personaly would like to find a system tray app that can allow usb storage on a per session basis.

    Alan.

  12. #12

    Geoff's Avatar
    Join Date
    Jun 2005
    Location
    Fylde, Lancs, UK.
    Posts
    11,802
    Thank Post
    110
    Thanked 583 Times in 504 Posts
    Blog Entries
    1
    Rep Power
    224

    Re: Restrict Kids from Installing ANYTHING

    How about a GPO ADM template? Per Machine but meh..

    1.) Take the following text, copy it, and paste it into a text document. Then, save it as USBSTOR.ADM.

    Code:
    CLASS MACHINE
    CATEGORY "Custom Policies"
    KEYNAME "SYSTEM\CurrentControlSet\Services\UsbStor"
      POLICY "USB Mass Storage Installation"
       EXPLAIN "When this policy is enabled, USB mass storage device permissions can be changed by using the drop down box.
     
    Selecting 'Grant Permission' will allow USB mass storage devices to be installed.  Selecting 'Deny Permission' will prohibit
    the installation of USB mass storage devices.
     
    IF REMOVING THIS POLICY: Reset to original setting and let policy propegate before deleting policy."
         PART "Change Settings:" DROPDOWNLIST REQUIRED
           VALUENAME "Start"
           ITEMLIST
            NAME "Grant Permission" VALUE NUMERIC 3 DEFAULT
            NAME "Deny Permission" VALUE NUMERIC 4
           END ITEMLIST
         END PART
       END POLICY
    END CATEGORY
    2.) Open a group policy management console, and right click on "administrative templates" under "Computer Configuration". Select "Add/Remove Templates".

    3.) Browse to the text document you just saved and click OK. You'll now see "Custom Policies" under "Administrative Templates". Right click on it, select "View", then select "Filtering". Uncheck the bottom box, labeled "Only show policy settings that can be fully managed".

    4.) Click ok. Now you'll see the USB policy available for use under the custom policy heading. From there, you can enable or disable it just like any other policy.

  13. #13
    ICTNUT's Avatar
    Join Date
    Jul 2005
    Location
    Hereford
    Posts
    1,419
    Thank Post
    196
    Thanked 249 Times in 122 Posts
    Rep Power
    62

    Re: Restrict Kids from Installing ANYTHING

    Thanks for the feedback guys,

    I am taking GrumbleDook's option to use Software Restriction Policies and flip things on thier head bt denying everything and only allow the apps I want them to use.

    I have set up a 3 machince testing network to try it out, once I am happy with it I'll rollout across the school.

  14. #14

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,262
    Thank Post
    242
    Thanked 1,568 Times in 1,250 Posts
    Rep Power
    340

    Re: Restrict Kids from Installing ANYTHING

    I also (in the past) have experienced problems users installing software. Of course restricting applications from the web is one method, but the other is to restrict the available drive letters. This does involve editing a group policy, but it isn't too hard to do. If you'd like to know how, I'll locate the exact policy you need to edit to achieve such a result.

    The end result, is that the network drive(s) are accessible, but even if someone plugs in a USB drive, explorer won't do anything as it has no letter to allocate the drive. Simple, but it works!

  15. #15
    ChrisH's Avatar
    Join Date
    Jun 2005
    Location
    East Lancs
    Posts
    4,998
    Thank Post
    120
    Thanked 280 Times in 258 Posts
    Rep Power
    106

    Re: Restrict Kids from Installing ANYTHING

    Thats what I do seems to work ok .

SHARE:
+ Post New Thread
Page 1 of 4 1234 LastLast

Similar Threads

  1. Kids Installing Firefox
    By tomscaper in forum Windows
    Replies: 30
    Last Post: 17th October 2007, 11:29 AM
  2. Restrict Logon
    By DSapseid in forum Wireless Networks
    Replies: 7
    Last Post: 28th March 2007, 10:30 AM
  3. Restrict filetypes
    By Gatt in forum How do you do....it?
    Replies: 21
    Last Post: 22nd September 2006, 11:28 AM
  4. restrict pupils printing
    By chrbb in forum How do you do....it?
    Replies: 3
    Last Post: 6th July 2006, 07:51 AM
  5. Restrict Access To USB Devices
    By MuppetQueen in forum Wireless Networks
    Replies: 25
    Last Post: 15th December 2005, 04:53 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •