SCCM Software Center / Permissions

[SteveM555]

Hello,

 

I am looking for a bit of advice. We have a newly setup SCCM 2012 server and everything seems to be working fine so far, however, I would like to only show software available in the Software Center to certain users (e.g.only Staff) and I am unsure of the best way to set this up.

 

Would I need to create a new user collection? and specify this in the Deployment of the software... or is there a way of targeting a specific AD Group when deploying software?

 

Thanks for any help.

[Sagima]

Pretty much - this is how i did it

 

I was never going to be letting students install anything so I set the user discovery to be the staff account ou and then I just created a allstaff user collection consisting of al the discovered users and published what I wanted to that. The couple of times I needed software to be available only to a few people (library, registrar, science) I just created a direct membership group with the right people from the discovered users.

[SteveM555]

I've just found out about using SQL queries to link a User collection to an AD Group.. That works fine now!

 

How do people go about denying students access to the software center completely?

 

Thanks

[free780]

App locker will do it.

[SteveM555]

App locker will do it.

 

This won't interfere with the installation/deployment of applications will it? I still want to be able to deploy software (remote control, inventory) etc whilst the user is logged on, just not launch the software center.

 

Thanks

[free780]

You could Deny "C:\Windows\CCM\ClientUX\SCClient.exe" if you are using the new software center. or c:\windows\ccm\scclient.exe if using the old silverlight one. You just need to do it for your student ad group. It shouldn't interfere with required deployments. Though always test before pushing out settings.

[SteveM555]

You could Deny "C:\Windows\CCM\ClientUX\SCClient.exe" if you are using the new software center. or c:\windows\ccm\scclient.exe if using the old silverlight one. You just need to do it for your student ad group. It shouldn't interfere with required deployments. Though always test before pushing out settings.

 

Thanks for that! Just tested it and it's blocked by GPO and I can still remote control, deploy software/updates!

 

Cheers!