The safety of a computer or local network can be compromised by incorrect actions of employees. In this case, it becomes necessary to prohibit the installation of programs by insufficiently qualified users.
Instructions
Step 1
To set such a ban, you need administrator rights. Assign rights to each user on the system. To do this, call the command line by pressing Win + R and enter control userpasswords2. Check the user account and click Properties. In the "Group Membership" tab, set the "Access Level" switch to the desired position
Step 2
In the command line enter secpol.msc and confirm with OK. In the Operations Console window, double-click the Software Restriction Policies snap-in. If a system message appears stating that the policy is empty, choose New Policy from the Actions menu.
Step 3
In the "Object type" section, double-click the "Assigned file types" item, mark the files with the LNK extension in the list and click "Delete"
Step 4
In the same section, expand the Enforce item and assign restriction policies to all application files and to all users except local administrators. Confirm by clicking OK. Expand the "Security Levels" folder, double-click on "Not Allowed" and in the properties window click on "Default"
Step 5
To prevent the installed programs from starting, open the "Additional Rules" snap-in and on the right side of the screen call the drop-down menu by clicking the right mouse button. Select Create Path Rule. In the new rule window, click the Browse button and specify the path to the folders where the programs are installed.
Step 6
Now you need to configure the permissions for these folders. Expand the folder and in the "Tools" menu check the "Folder Options" command. In the "View" tab, uncheck the box next to "Use basic sharing …"
Step 7
Right click on the folder icon and select the Sharing and Security option. In the "Security" tab, mark users one by one and in the "Permissions" section put a check mark in the "Allow" checkbox opposite the "Reading" item. Click Advanced. In the window of additional parameters in the "Permissions" tab, mark the user group and click "Change". Mark with checkboxes the actions that are allowed and denied for this group.
