Controlling User Program Installation and Removal

In many cases, you may not want users in your environment installing and removing programs. As I have mentioned before, user installations and removals can become a problem for help desk technicians, so many environments choose to control users and limit what users can and cannot do with programs. There are a few different issues to consider.

XP User Accounts

Windows XP provides local user accounts as Administrator accounts and Limited accounts. Limited accounts cannot make changes to hardware or system configuration changes. They are also limited when installing programs. Depending on your network, you should consider giving users only limited accounts locally on Windows XP, with only certain users having administrative accounts on the computer. This can greatly cut down on problems since Windows XP prevents limited accounts from doing anything drastic, including program management. However, some older programs may not work well when users are logged on with limited accounts, so keep this in mind as you experiment with older programs. If you are in a domain environment, domain administrators may manage domain user accounts in such a way that users are limited from installing programs as well.

Domain Group Policy

In a domain environment, domain administrators may use domain Group Policy, configured on Windows 2000 Server, in order to control users and software. Using domain Group Policy, domain administrators can even install and remove software automatically from users’ computers without any user interaction at all, which is a great management technique. Domain Group Policy can be applied at the site, domain, and organizational unit levels.

Local Group Policy

On Windows XP Professional, a local computer administrator can also enforce local Group Policy on other users who log on to the computer. This is yet another way to control what users can and cannot do on the computer, including software installation and removal. Using local Group Policy, you can invoke a setting that removes Add/Remove Programs from Control Panel that will further limit what users can do. The following steps walk you through this process.

Enforcing Local Group Policy

1. Log on to a Windows XP Professional computer with a local administrator account.

2. Click Start | Run. Type MMC and click OK.

3. In the MMC window, click File | Add/Remove Snap-in.

4. In the Snap-in window, click Add.

5. In the Snap-in dialog box, select Group Policy and click Add. A window appears asking whether you are using local Group Policy. Click OK and click Close.

6. The Group Policy console is now available, as shown here.

   

7. Expand User Configuration, Administrative Templates, Control Panel, Add/Remove Programs. Open the Remove Add/Remove Programs policy and enable it, as shown here.

   

8. Click OK and close the Group Policy console.