Blocking Unwanted programing from installing

[kerrjar at gmail.com (Aaron Moss)]

Having dealt with several SBS 2003 environments for the last couple years,
locking down and stripping admin rights from the users is the best way to
manage this. Then they can't install anything to the necessary directories.
It's a pain in the neck if there's something that HAS to be installed for
one of the users, then you'll have to do it for them, but then you SHOULD
have the most control over the environment.

My hands have taught me terrible things...
His Hands have SET ME FREE!

If a falling cat always lands paws down, and a falling peanut butter
sandwich always lands peanut butter down, then a cat with an open face
peanut butter sandwich strapped to its back will hover above the ground in a
state of complete and total indecision.



On Sun, Apr 4, 2010 at 12:24 PM, Butturini, Russell <
Russell.Butturini at healthways.com> wrote:

> In 2003 environments you can set group policy to disable the windows
> installer on workstations.  However this won't knock out third party
> installation packagers.  The best thing to do is strip local admin rights
> from the users and prevent them from writing files to key directories
> (program files, system32, etc.)
>
> ----- Original Message -----
> From: Sherwyn <infolookup at gmail.com>
> To: Butturini, Russell; 'pauldotcom at mail.pauldotcom.com' <
> pauldotcom at mail.pauldotcom.com>
> Sent: Sun Apr 04 12:15:19 2010
> Subject: Re: [Pauldotcom] Blocking Unwanted programing from installing
>
> The are running 2003.
>
> Thanks.
> Infolookup
> www.infolookup.blogspot.com
> www.twitter.com/infolookup
>
>
> -----Original Message-----
> From: "Butturini, Russell" <Russell.Butturini at Healthways.com>
> Date: Sun, 4 Apr 2010 10:57:15
> To: 'infolookup at gmail.com'<infolookup at gmail.com>; '
> pauldotcom at mail.pauldotcom.com'<pauldotcom at mail.pauldotcom.com>
> Subject: Re: [Pauldotcom] Blocking Unwanted programing from installing
>
> What version of SBS are you dealing with? 2003 or 2008? You have some more
> capabilities in 2008 than 2003 for this sort of thing,
>
> ----- Original Message -----
> From: pauldotcom-bounces at mail.pauldotcom.com <
> pauldotcom-bounces at mail.pauldotcom.com>
> To: PaulDotCom Security Weekly Mailing List <
> pauldotcom at mail.pauldotcom.com>
> Sent: Sat Apr 03 20:34:27 2010
> Subject: [Pauldotcom] Blocking Unwanted programing from installing
>
> Hello PDC Guru's,
>
> I am task with locking down a Microsoft SBS environment. The goal is to
> allow all currently installed application to be able to run but stop the
> installation of any new application (limewire, AOL messenger etc).
>
> I am aware that I can use a Run only list or software restriction "path
> rule", but since both of these can be very time consuming if the users has
> lots of application installed.
>
> Is there anyway to just allow all currently installed aops run access but
> block installation of new apps for a set of users?
>
> Thank you in advance.
>
> Infolookup
> www.infolookup.blogspot.com
> www.twitter.com/infolookup
>
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
>
>
>
> ******************************************************************************
> This email contains confidential and proprietary information and is not to
> be used or disclosed to anyone other than the named recipient of this email,
> and is to be used only for the intended purpose of this communication.
>
> ******************************************************************************
>
>
> ******************************************************************************
> This email contains confidential and proprietary information and is not to
> be used or disclosed to anyone other than the named recipient of this email,
> and is to be used only for the intended purpose of this communication.
>
> ******************************************************************************
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20100404/fa1d3ed7/attachment.htm