Group Policy Editor "Disable Software Install"

[chubalz]

How to disable from installing software using gpedit.msc?

User Account is Administrator.

I want to block different kinds of software.

Utorrent
Internet Download Manager
Etc.




And also if the software was already installed like Google Chrome.

What will happen if chrome is updating? will the update be successful? even in group policy is restricted to install?


Thanks in advance.

 

[phantomofrussia]

Editing the Local Group Policy to block people from installing software is a little extreme in my opinion. It can certainly be done but it might just be easier to create another user account that is a standard user account and have everybody use that. If they try to install something, they will need admin permissions to do so.

Just my 2 cents.

 

[Brink]

In addition, it would be pointless to try and block an administrator account since they are able to just as easily unblock it with their own administrator rights.

The only true way is to make them standard user accounts as PhantomofRussia posted above.

 

[LMiller7]

Trying to limit what an admin account can do is an exercise in futility. Any policy you put in place can be modified or removed by any other admin. All of this is by design. All admin accounts are equal. The built in Administrator account is a little different but not relevant to this situation.

 

[chubalz]

Tnx phantomofrussia, Brink and LMiller7 for the reply.

Well im the only person who will knows how to do it. They cannot unblock it.

How about applocker?

Can applocker block specific software from installing? even if its not installed yet?

 

[phantomofrussia]

chubalz, please try to understand that what you are trying to do is hammer in a nail with a sledgehammer. Extreme overkill. Local Group Policy and Applocker are primarily used in a domain environment by system administrators. Even then in those environments do they rarely allow users to have an admin account on the computer.

As Brink and LMiller7 have said even though you lockdown the computer through Group Policy or AppLocker, the users will have admin rights on the computer. Let me tell you from expierence, when a user wants to do something like install a program, they will start to try and do that. That may involve them messing around with the system and since they have admin rights, they might break something and have fun fixing that then. They might go onto a forum and ask how to do that. They will either accomplish that or they will break something and then you will be stuck fixing it.

There is a reason why you can have a standard user that is only able to basic things on a computer and this would be one of them.

 

[LMiller7]

There are 2 solutions for your problem.

1. Make the users limited users, not admins. Many organizations are doing this and you need to consider it.
2. If the users must be admins. Establish policies known to all regarding what is permitted and what is not. Having admin rights is a position of trust and users must show that they are worthy.

Limiting the powers of an admin account is NOT a viable option.

 

[Layback Bear]

From post #8 by LMiller7.

Having admin rights is a position of trust and users must show that they are worthy.

That says it all.
If the trust is lost then so is the administrator privileges.

 

[chubalz]

Btw. im using Deep Freeze.

So even in admin rights they cannot save settings upon restarting the computer.