restrict user to use Application,USB,CDROM on standalone workstation

yes Gokay it is on default and i raised it up one level on administrator account . i didn't found UAC in a user account

expressions said:

UsernameIssues yes this is exactly what i need.

just now i tried to install nero on a standard user i created and its able to install that program. thats not good.

There are lots of apps that will install without admin rights. Chrome is one of them. I see that you are locking out portable apps by locking out USB/CD/DVD. Hopefully, the computers do not have Bluetooth.

I cannot help much with the lock down and I doubt that you can find an easy way to limit the time that an app runs for a user. It would probably require 3rd party software. A scripting tool like Powershell or AutoIt might do what you want... but you would have to write the code.

expressions said:

yes Gokay it is on default and i raised it up one level on administrator account . i didn't found UAC in a user account

UAC settings are computer wide. If the UAC slider is at the top for the admin account, then it is at the top for every user - standard or admin.

If I am understanding you correctly...
...you could get a phone call from a user at 9am
...you remote into a the computer being used by that user
...you right-click on an app and select run as admin from the context menu
...you enter the admin credentials
...you end your remote control session
...the user that called you uses the app that you started
...that app automatically ends one* hour after you started the app.

*or some other length of time.[/QUOTE]

UsernameIssues yes this is exactly what i need.

just now i tried to install nero on a standard user i created and its able to install that program. thats not good.

I was restating part of what you wanted so that others would know that Parental Controls and Group Policies would not do that. Windows will not limit the time that a user can use an app like I described without 3rd party software. I don't know of any software that will do this. Someone might need to write it within your company.

Users may have problems running software using credentials other than their own. For instance, if the user tries to save a file to the desktop, it will be saved to the desktop folder under your user profile, not their desktop folder.


As far as preventing installations and the running of portable apps, you might be able to do this via white listing apps in local policies. You should experiment on frozen Virtual Machines.