Stop users installing programs

subbass · 19 Nov 2012 at 15:08

What are ways to prevent users installing apps like Skype, Dropbox, web browsers, toolbars etc..?

These programs do not require admin privileges as they install to their own profiles rather than Program Files. We use Win 2k3 at work so no Applocker. Software restriction policy in Group Policy is possible but someone who is a little tech savvy can just rename the exe file and then install.

Any suggestions?

Thanks.

Uhtred · 19 Nov 2012 at 15:21

What AV do you run? Quite often they have a component which can block those applications.

You should be able to use a hash for application blocking with software restrictions.

subbass · 27 Nov 2012 at 19:42

Kaspersky.

The problem with blocking with file hashes is that (as far as I'm aware) it will be hard to maintain and keep up as programs are updated.

Any other ideas?

theheyes · 27 Nov 2012 at 21:37

Personally I would implement the software restriction policy (don't kill yourself trying to keep up with the hashes but do at least something) and then make it clear in your acceptable use policy that trying to circumvent the restriction is not permitted.