Users able to install and run some exes (teamviewer)

[chazzy2501]

My Teachers are regular domain users on their own laptops without the ability to install programs or even drivers for their printers. (Great this is what I want) They are in no special group on their laptops!

 

Domain authenticated users nothing more!

 

Why then can they go to the teamviewer website and run an exe from the web that allows remote users to see their desktop and transfer files! Another teacher had an installer called freeridegames! What have I missed?

 

if I try to install anything it prompts for elivation and thats where it should fail. I saw the team viewer program install and run without ever asking for the admin password...

 

Thank goodness the pupil proxy filters exes or I'd be hosed.

 

Again, what have I missed? This is all Windows 7 Enterprise.

[cpjitservices]

could you not just block team viewer website or the link to the download into your filters to stop them from accessing the site altogether ?

 

As for actually blocking the file I'm not sure why it would not ask for privileges, although there is a version of TV that doesn't install you can just run it so maybe that's why it didn't ask for elevation.

[Ashm]

You need to look at Software Restriction Policies in Group Policy. Domain Users can still run EXE's unless locked down with SRP. As long as the program doesn't require access to areas they would not have access to as a standard domain user such as C:Program Files etc then things like Teamviewer will be able to be run.