Group Policy to prevent staff from installing software

[talksr]

Hi there,

The school I am working with has used Ranger 8.0 for a number of years to control users and permissions.

 

I am noticing with their new Windows 10 systems that staff are able to install whatever they like onto a system and they are not being prevented from doing so or being asked for an admin password.

What is strange is that once staff log out, if I log in, I am unable to find the software on Programs and Features.

 

Does anyone know how best I can lock this down?

Each teacher user is a member of the following:

Remote Desktop Users

Teaching Staff Group - Teaching Staff Group is a global security group I created to group them all together for desktop redirection etc.

 

I have checked the ranger permissions and TeachingStaffGroup has C and Q drives set to illegal. If a user even tries to open C, it will close down the explorer so I am not sure how this is even allowing them to install the software in the first place as they don't have access to C. Also their personal S drives do not have any software installed into them.

[penfold]

Applocker? I noticed that users were trying to upgrade firefox here and because they had limited access it ended up installing it in their profile. Hence the reason you won't see it when you log on. I'm assuming the users are not local admins which should limit most things?

[talksr]

Applocker? I noticed that users were trying to upgrade firefox here and because they had limited access it ended up installing it in their profile. Hence the reason you won't see it when you log on. I'm assuming the users are not local admins which should limit most things?

 

Not heard of that before. As far as I can see from how it has been set up, they are not local admins, just part members of Remote Desktop Users and Teaching Staff global security group. Is there any way I can easily check they are 100% not a local admin?

[Geoff]

The following Powershell will work

 

$userToFind = $args[0] 
$administratorsAccount = Get-WmiObject Win32_Group -filter "LocalAccount=True AND SID='S-1-5-32-544'" 
$administratorQuery = "GroupComponent = `"Win32_Group.Domain='" + $administratorsAccount.Domain + "',NAME='" + $administratorsAccount.Name + "'`"" 
$user = Get-WmiObject Win32_GroupUser -filter $administratorQuery | select PartComponent |where {$_ -match $userToFind} $user