Students can install software! I can't find where this was set.

[BBrian]

I'm doing a bit of work in a school where the last guy set up the 2003 domain as if it was NT. GPMC wasn't installed when I arrived. He has given students permission to install whatever they want. I can't find where he gave them this ability. I've looked at the Default Domain Policy, run RSOP on the OU containing the student account, and then searched in AUDC for Authenticated Users being a member of Administrators etc. I also created a test account and it had all the permissions it shouldn't, too.

 

Anyone any ideas?

[Stuart_C]

Have you looked on the local computer? Maybe the "domain users" has been added to the PC's Local admin group? Or something allong those lines?

[ChrisH]

Look under restricted groups in the relevant GPOs.

[ronnoco]

Not sure of the top of m head but whilst you get to the bottom of you could use GP to disable running of extensions associated with software such as .exe, .msi, etc....this will be a temporary fix.

[oxide54]

if you install XP fresh on a computer and join it to the domain do they still have the permission?

 

at least that way you will know whether its in a GPO or just on the machines,

[3s-gtech]

Do you have a GPO for your students now? An important setting is in User Configuration/Administrative Templates/Windows Components/Windows Installer - Always install with elevated privileges.

 

I have also found that programs that don't use the Windows Installer to install have managed to get onto the system - I have denied students write access to the root of C:\ and root of Program Files using Security Policies.

[Hecate]

Have you tried modelling the group policy - this will show you which policies are being applied to an OU

[BBrian]

Great suggestions, thanks. Here's what I found.

 

if you install XP fresh on a computer and join it to the domain do they still have the permission?

 

at least that way you will know whether its in a GPO or just on the machines,

 

I joined a VM to the domain and the pupil account was just a regular user account. So:

 

 

Have you looked on the local computer? Maybe the "domain users" has been added to the PC's Local admin group? Or something allong those lines?

 

Domain Users had been added to Administrators on the local computer! So what I did was:

 

 

Look under restricted groups in the relevant GPOs.

 

And read up on it at WindowSecurity.com and fixed it.

 

 

The other posts were good ideas but I'm glad to have corrected this properly.