From: John Holmes on
jaster "contributed" in

> On Fri, 29 Aug 2008 15:38:45 +0100, Mike thoughfully wrote:
>> On Thu, 28 Aug 2008 23:07:51 GMT, jaster <jaster(a)> wrote:
>>>On Thu, 28 Aug 2008 20:20:52 +0100, Mike thoughfully wrote:
>>>> Win Xp Pro. Relatively experienced user however i am stuck on the
>>>> below
>>>> I have 2 users admin and a limited. The limited can still install
>>>> software etc.
>>>> How do you change other permissions for the limited user to select
>>>> exactly what they can do?.
>>>> TIA
>>>Interesting. They can install software that only available to that
>>>user, ie, only Admin and that user can execute that software?
>>>Otherwise that shouldn't happen.
>>>Try menu, administrative tools, local security policies, local
>>>policies, user rights assignment and security options.
>>>I use the classic style task menu but if you use category menus start
>>>at Performance and Maintenance.
>> I believe it was something like Winzip they installed. It was some
>> software utility. I was under the impression limited users could not
>> install anything.
>> Thank you for the information as to where permissions are located. I
>> have now looked their but can't see anything related to installing
>> software. Any ideas
> Sorry not really. M$ assumed programs installed by users would be
> limited just to those users.


> Maybe removing the add/remove programs option from the menus or
> restricting appwiz.cpl to administrators? Then at least the only
> programs that have self installers will be installed.


> The option used by windows based schools is to reinstall the base
> configurations for users each night. That would be to overlay the
> users windows PC with the bootstrap version.

Never heard of a DC with AD, eh?

> Or you could use PCs with user partitions that could be deleted each
> day. Like a D:\ with a D:\windows and D:\program files so any
> installed programs are installed automatically to D:\program files
> instead C: \program files and C:\windows which have the original
> Windows files.

Bullshit. Any computer within a domain can be controlled by the domain
controller. Per computer or per user. On a local computer, all the OP has
to do is run gpedit.msc to prevent users from installing software.