📎 AI Summary:
The original poster asks how to block program installations in Active Directory. A responder clarifies that AD is primarily for authentication and suggests using AppLocker through GPO to block executables, but notes it doesn't differentiate between installers and regular programs. They also mention controlling access to the Windows Installer service and recommend restricting local admin rights as the most effective approach. The overall sentiment is informative, providing possible methods and limitations.
The original poster asks how to block program installations in Active Directory. A responder clarifies that AD is primarily for authentication and suggests using AppLocker through GPO to block executables, but notes it doesn't differentiate between installers and regular programs. They also mention controlling access to the Windows Installer service and recommend restricting local admin rights as the most effective approach. The overall sentiment is informative, providing possible methods and limitations.
Solution
- Joined
- Jul 4, 2015
- Messages
- 8,995
Active Directory is for authentication. You can block executables with app locker via GPO, but there ins't anything to distinguish between an installer and an actual user program.
You can also control access to the Windows Installer service via GPO, but not all installers use it. The best method would be to restrict local admin rights to those allowed to installed programs.
You can also control access to the Windows Installer service via GPO, but not all installers use it. The best method would be to restrict local admin rights to those allowed to installed programs.
Solution
Similar threads
- Article
- Article
- Article
- Article