Q: I support around 100+ users. I have asked them not to use things like "The Weather Bug," Internet Radio, Web Shots, etc. They will not listen. I have asked for content filtering software to run at the server to block access to these annoying and bandwidth-hogging applications to no avail. I have been told we don't want to be "Big Brother."
I can't seem to make upper management realize what an issue it is to have to troubleshoot computers that have useless and resource-eating software loaded. My question is: Is there anyway to block the Windows installer from installing anything other than what I want installed? Is there a better free solution to this problem?
A: Well, if you're using Windows Server 2003 for Terminal Services, then you can use Software Restriction Policies. If you're not, then you can try locking down the server with group policies, but I honestly don't know how much that will help you. If you don't mind spending some money to reduce the costs of supporting these users you could try an application-monitoring tool like Simplify Lockdown to prevent unauthorized applications from running.
You could also try blocking access to the sites in question, or only permitting access to approved sites. And don't forget to lock down Active Desktop to prevent Web content from running on the Desktop.
This was first published in August 2005