Students Installing to Profile Folder on Desktops

[pmaryan]

Students are only domain users and are not local administrators of the machines. I do not currently have software restrictions turned on.

Users have been able to download firefox and then when installing click cancel on the UAC prompt and then the software installs to the profile folder on the machine.

How do I disable all profile folder installs? It's driving me insane that they are able to install stuff, yet they aren't a local admin.

[ihaveaproblem]

Could you

1) Set up a redirection desktop and deny permissions to write files to it?
2) Set up a software restriction policy in GP that denys .exe from running from the locations you specify
3) If you use Symantec AV (Others can probably do it as well) you can set that to disallow programs from running.

[CyberNerd]

redirect the profile to a share and ban the filesystem from saving .exe .dll etc.

[pmaryan]

I'm liking option #2, but I've never looked into the giant ax that is software restrictions. Is it possible to precisely define that any software trying to run from C:\Users\%username% will not run, but everything else from (which is preloaded from me) will run okay?

[glennda]

I've just done it here - if you use a software restriction policy and then create a hash on both firefox.exe and firefoxsetup.exe it blocks it from running (even with a different name) - if let them install it and watch the smile come off there face when it won't run

[ihaveaproblem]

Our of interest anyone whos running Windows 7 enterprise have you tried AppLocker and how did you find it?

pmaryan, best way to set up software restriction is make a test account and only apply the policy to that one account. Then you can figure out what to block and if you do block any important stuff by mistake atleast it's only effecting your test