Stopping local laptop users installing software

[Little-Miss]

Is there a way?

 

I've been having a play with the Local GPO's on the staff laptops and i want to stop them being able to install software. At the moment i get a box up warning the user that things wont install properly if they dont have the right user rights. I selected the user and it started to install. What did i miss..

[t_h]

You need to deny the account they log in with local administrator rights. Are the laptops joined to a domain? and are you using Windows XP?

[Little-Miss]

it is windows XP and they do have a domain account...i've set the user up as restricted.

[azrael78]

The most effective way is to ensure that no user (except domain admins) have admin rights on the laptop itself.

 

This way, only software that is written for 'users' will ever install - and even then, it would have to install inside the users' local profile or any other area of the hard disk to which they can write.

 

You could use local GPOs to do this as well - but the problem is that if you lock it down too much, the local administrator also gets hit by it.

 

We got around this in the very early days of XP on our site by using NT4's Poledit locally with the updated .ADM files.

 

This meant all users could be locked down tight, except the local admin account.

 

While that would be horrible to do these days - this was before we even had a Win 2000 Server, let alone 2003/2008.

 

Years and years and years ago.

 

Az

[Little-Miss]

You could use local GPOs to do this as well - but the problem is that if you lock it down too much, the local administrator also gets hit by it.

 

Yup, found that out myself

[srochford]

Why does it matter? Typically, it's because you want to stop people messing up the laptop and then you have to waste time fixing it.

 

It may be better to take another approach but you will need management agreement. You then basically let staff do what they want but with the proviso that if the machine stops working (for any reason - misuse, misfortune etc) then you will wipe and reinstall. If you've got an image for the machine it's pretty quick to do that.

 

If you go down this route then you need to make sure you've got an easy way for users to backup their data. For example, you might give them an icon which they click when plugged into the network that uses something like robocopy to sync with a network share

 

If you try and lock down the machine you will get some people asking "why?" If the answer is "so you can't break it" then you're opening yourself up to nightmares when the machine breaks (and it's not the user's fault) - they'll then say "you must fix it" because you told them it was unbreakable.

 

There's a whole mass of software which is legal and justifiable even if you're taking the view that the computer can only be used for work; if you don't let staff install it themselves then you're going to have to do it for them which just makes more unnecessary work for you - something that you really want to avoid :-)

[Little-Miss]

very good point...

 

My head did agree that they shouldnt be able to install programs.

 

Before i joined the school the laptops were open to abuse and so now the staff are suffering...basically they'd take them home, let their kids use them...kids install whatever they liked and i end up with the machine thats full of viruses and refuses to do anything...

 

They are going to be imaged, have a domain logon and i was giving them a local logon one for use when at home. I then couldnt decide how to allow them to drag their work from the local to the domain so was just going to map them a drive...

Edited September 22, 2009 by Little-Miss

[HodgeHi]

The other point is having staff install stuff like lime-wire etc and downloading shed loads of stuff inc. the associated viruses and then bringing them all into the School's network. Where do we stand on software that is unlicensed as well as downloaded and illegal music.

[CyberNerd]

most of the stuff that staff want will install in "c:\program files" so if you either make sure that they are not a 'power user' or 'administrator' then they should not have permission to write there. or just take away the permissions to write on that directory, but making them standard users is a cleaner way of doing it.

[carni]

Have you thought about MS SteadyState?

 

Install it in the local admin account and if i remember correctly you can manage all the other local user accounts and set options to deny installing programs for each of these accounts.

[Little-Miss]

I did have a quick look at steadystate...and wasnt sure if it was right for what i needed. Will look properly.

 

Welcome by the way!

[bossman]

We don't allow access to the network (apart from internet access) from teachers laptops as people have openly discussed before it is an accident waiting to happen.

 

They are standalone units which we give admin access to and the teachers can do what they wish with them within the confines of normal use which covers installation of anything they wish and when they fill it full of virus they bring it to us and we re-image it takes 5 mins and hey presto back up and running.

 

They can get internet access from within the school but that is all nothing else.

So far it works really well and we don't get that many problems.

[Little-Miss]

Argh, this is one of my downfalls in IT....there are so many ways to do one thing and i cant make decisions!!!

[witch]

We've just changed over from bossman's scenario to a synched system whereby they look like they are on the network whether they are or not - basically because our system denied them access to their own C drive if they were on the network and they got cross because they couldnt access their stuff. We never mapped them a drive as they could install goodness knows what on their machines and I didnt want it on my server.

What they dont know, yet, is that they now cant install any programs!! Or change the desktop. This way they remember it is a school machine and not their own personal one, and it keeps rubbish and viruses off my server...

The simple answer is put them on the network and lock 'em down, or keep them off it and let them do what they like:)

[deKay]

Have you looked into whether your virus killer can stop this?

 

We use Symantec Endpoint Protection, and it is configured such that EXEs can't be run from any removable drive, and users are not local admins. It doesn't stop everything, but it helps.

[Mr.Ben]

I've used a whole range of methods, both user and machine based..

 

First off, I've created a workstation OU and moved all the computers into it

 

Then GPO's for users:

 

User Configuration\Adm Templates\Windows Components\Windows Installer\Prenvent Removable Media Source for Install: Enabled

 

User Configuration\Adm Templates\System\Don't run specified Windows Applications:Enabled

 

Add Install.exe, Setup.exe, Install.bat, Setup.bat - I do realise this only takes a rename to circumvent, but how many staff will do that?

 

Then GPO's for the workstation:

 

Computer Configuration\Adm Templates\Windows Components\Windows Installer\Disable Windows Installer: Enabled, For non-managed apps only.

 

Then I removed security rights to the local machine by downgrading the user accounts

 

I have used File Screening (for exe's , bat's and msi's) on my Server to stop install from there, enabled our filtering proxy to refuse staff the ability to download program files]

 

Finally on staff laptops there are two partitions (C: and M:). The C:\ drive is completely hidden and the staff My Documents are redirected to their Network Folder and copied using Offline Files. the M drive is for personal use for their music etc.

 

Finally, write an AUP for the software, if you have the backing of SMT this will be easy. Remember the School owns the computers - and remind Staff of this at every opportunity - Put a legal text in between Ctrl-Alt-Delete and the login screen:

 

The reg keys for that are in HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon

 

Some of the changes here mean that the domain administrator can't install programs if they are not done through GPO. I'm fine with this and use the Local administrator (as GPO's shouldn't affect this account).

[witch]

Some of the changes here mean that the domain administrator can't install programs if they are not done through GPO. I'm fine with this and use the Local administrator (as GPO's shouldn't affect this account).

 

Which ones? I am looking to stop the children installing off a memory stick and it looks like one of your fixes will work- but will it stop install by admin?

[Little-Miss]

thanks for the detailed post Mr. Ben!!

[Mr.Ben]

Which ones? I am looking to stop the children installing off a memory stick and it looks like one of your fixes will work- but will it stop install by admin?

 

 

The computer configuration policy will disable windows installer if you login as the domain admin, it applies to the machine when a domain user (of any sort) is logged in. I must say that's an assumption as all the other workstation gpo's apply - time to go and see if I can do it!

[Mr.Ben]

 

Then I removed security rights to the local machine by downgrading the user accounts

 

QUOTE]

 

That needs a little more explaination, basically the domain users have no rights over the C:\ drive. As the staff profiles are cached on the machines this continues even when off the network.

 

If a particularly nasty piece of software needs these rights, you can give them back via gpo:

 

ComputerConfiguration\Windows Settings\Security Settings\File System

 

You'll need to give security rights over the folder within program files (and you have to browse to the folder, so it has to be installed).

[penfold]

I've used Witch's method of get them on the network and use the network restrictions or leave them as stand alone and let the teachers do what they want. Just take an image first and when there is any problems, just reimage. Or of course just do a reinstall as stated by other members.

 

Just make sure that the teachers know they need to do their own backups if they are stand alone so you dont get any stick. Works for us.

[Little-Miss]

I've actually come to that conclusion Penfold. I'm just making more work for myself and they're not children. So im gonna give them the benefit of the doubt this once and see if they ruin it for themselves.

 

I'm going to just give them their domain and add a local with no restrictions. I've used edugeeks laptop policy and im just going to put in there that they are not to install software and that are responsible for their own backups...obviously i need to make sure the head is ok with this but i cant see that he wont be.

 

But still a very helpful post Mr Ben

[powdarrmonkey]

I've actually come to that conclusion Penfold. I'm just making more work for myself

 

 

Cover your back by making it clear that it's their responsibility and that if it breaks, it'll go back to how it was issued, no questions asked. Take a clean image and restore that when things go wrong.

 

It's just simpler

[Little-Miss]

Thanks Monkey!