+ Post New Thread
Results 1 to 6 of 6
Windows 7 Thread, Students Installing to Profile Folder on Desktops in Technical; Students are only domain users and are not local administrators of the machines. I do not currently have software restrictions ...
  1. #1

    Join Date
    Jul 2011
    Location
    Rochester, NY
    Posts
    5
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Students Installing to Profile Folder on Desktops

    Students are only domain users and are not local administrators of the machines. I do not currently have software restrictions turned on.

    Users have been able to download firefox and then when installing click cancel on the UAC prompt and then the software installs to the profile folder on the machine.

    How do I disable all profile folder installs? It's driving me insane that they are able to install stuff, yet they aren't a local admin.

  2. #2

    Join Date
    Jun 2010
    Location
    England
    Posts
    735
    Thank Post
    89
    Thanked 52 Times in 46 Posts
    Rep Power
    35
    Could you

    1) Set up a redirection desktop and deny permissions to write files to it?
    2) Set up a software restriction policy in GP that denys .exe from running from the locations you specify
    3) If you use Symantec AV (Others can probably do it as well) you can set that to disallow programs from running.

  3. #3


    Join Date
    Jan 2006
    Posts
    8,202
    Thank Post
    442
    Thanked 1,032 Times in 812 Posts
    Rep Power
    339
    redirect the profile to a share and ban the filesystem from saving .exe .dll etc.

  4. #4

    Join Date
    Jul 2011
    Location
    Rochester, NY
    Posts
    5
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    I'm liking option #2, but I've never looked into the giant ax that is software restrictions. Is it possible to precisely define that any software trying to run from C:\Users\%username% will not run, but everything else from (which is preloaded from me) will run okay?

  5. #5

    glennda's Avatar
    Join Date
    Jun 2009
    Location
    Sussex
    Posts
    7,799
    Thank Post
    272
    Thanked 1,134 Times in 1,030 Posts
    Rep Power
    349
    I've just done it here - if you use a software restriction policy and then create a hash on both firefox.exe and firefoxsetup.exe it blocks it from running (even with a different name) - if let them install it and watch the smile come off there face when it won't run

  6. #6

    Join Date
    Jun 2010
    Location
    England
    Posts
    735
    Thank Post
    89
    Thanked 52 Times in 46 Posts
    Rep Power
    35
    Our of interest anyone whos running Windows 7 enterprise have you tried AppLocker and how did you find it?

    pmaryan, best way to set up software restriction is make a test account and only apply the policy to that one account. Then you can figure out what to block and if you do block any important stuff by mistake atleast it's only effecting your test

SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 0
    Last Post: 8th June 2011, 10:21 AM
  2. Replies: 5
    Last Post: 9th May 2007, 05:45 PM
  3. Replies: 4
    Last Post: 24th January 2007, 11:39 PM
  4. Allowing access to a single folder on C:
    By Ric_ in forum Windows
    Replies: 5
    Last Post: 2nd November 2005, 11:51 AM
  5. Replies: 6
    Last Post: 20th October 2005, 06:48 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •