How to deny access to Device manager in standard user account?

MataC said:

Aha, so it's basically impossible to put any kind of restriction on the default Windows 7 account because its a 1 level down administrator account.

Is it possible then to allow limited/standard users to uninstall and install programs and change folders?

This may be possible in theory but it wouldn't be useful. Installing applications requires a lot of high level permissions and any account that has that would for most practical purposes be an admin account in all but name. Such an account could do a lot of damage to the system, whether by accident or intent. Any account that can install applications can uninstall them as well. Any attempt to restrict an admin level account is an exercise in futility. Any restriction you might put in place can be removed by any other admin. This an inherent characteristic of an admin account and cannot be removed.

By design an admin level account is the highest user account in the system and has complete control over the computer. It was intended that there would be one or a small number of trusted individuals with such an account. Trust is essential. If someone cannot be trusted with an admin account they shouldn't be given one. It is as simple as that.

LMiller7 said:

MataC said:

Aha, so it's basically impossible to put any kind of restriction on the default Windows 7 account because its a 1 level down administrator account.

Is it possible then to allow limited/standard users to uninstall and install programs and change folders?

This may be possible in theory but it wouldn't be useful. Installing applications requires a lot of high level permissions and any account that has that would for most practical purposes be an admin account in all but name. Such an account could do a lot of damage to the system, whether by accident or intent. Any account that can install applications can uninstall them as well. Any attempt to restrict an admin level account is an exercise in futility. Any restriction you might put in place can be removed by any other admin. This an inherent characteristic of an admin account and cannot be removed.

By design an admin level account is the highest user account in the system and has complete control over the computer. It was intended that there would be one or a small number of trusted individuals with such an account. Trust is essential. If someone cannot be trusted with an admin account they shouldn't be given one. It is as simple as that.

Ok, I understand all that, but I'm still interested how can this be done. Via group policy maybe?