Prevent Installation of software

[xarden]

Hi all.

How would I go about preventing all students from installing software in classrooms?

There are some limitations as to what we can do.
..It needs to be done, preferably if possible, by group policy. We are running a 2003DC. (if a 2008dc is required, excellent. The more excuses to get one of these, the better)

..It also needs to be enforced regardless of if the PC or notebook or netbook is on or off the network. A local GPO might be possible if domain GPO isnt.

..There are only two local accounts, both generic administrator accounts for the Tech Staff. They will need access to install programs.
There is to be no other local accounts or guest accounts. At all.

..Deep Freeze is installed. It does not prevent installation, but it does remove any local changes on reboot. Some labs do not reboot or shut down.

..No other 3rd party tools to be used. Only genuine Microsoft products.
..We are not and will not be using SCCM, MDT, WDS.

I hope I've provided enough info.

I've also just tested the 'Disable Windows Installer' GPO, it doesnt work with software that doesnt use Windows Installer.
'Remove add/remove programs from Control Panel' is also enable. This also doesnt work, as most programs have their own Installers/uninstallers.

Cheers,

 

[WindowsStar]

All machines are on Windows 7 Enterprise (x64)?

 

[gregrocker]

Why are students being allowed to operate as Adminstrators? That is a glaring deficiency in the setup.

They should use a regular User account (named Student or such) so Administrator account only needs to then be passworded to restrict them from installing anything.

Why use a standard user account instead of an administrator account?

The standard account can help protect your computer by preventing users from making changes that affect everyone who uses the computer, such as deleting files that are required for the computer to work. We recommend creating a standard account for each user.
When you are logged on to Windows with a standard account, you can do almost anything that you can do with an administrator account, but if you want to do something that affects other users of the computer, such as installing software or changing security settings, Windows might ask you to provide a password for an administrator account.

 

[Bill2]

1) If you are on Enterprise, Applocker should do the trick for you. Here is a good overview with multiple links.

AppLocker Documentation for Windows 7 and Windows Server 2008 R2

2) If you are using consumer versions of win7 (higher than home premium), you can use the Group policy to impose various restrictions on installing and running software but those will apply on "Standard" users, not Admins. As Greg said, its a bad idea to have students logging in as admins. This article explains things much better than I do, so take a look.

How to restrict users from installing programs in Windows 7 | The Windows Club

 

[WindowsStar]

Thanks gregrocker and Bill2.

 

[xarden]

Thanks Bill2, I'll look into those.
@WindowsStar: Yes, its Win7 x64 Enterprise.

 

[azlanlol]

how about windows 7 pro x64bit?