0

I have one admin account and 2 standard user accounts on a local computer and not on a domain. For example,

User A -> (Admin Account)

User B -> (Standard Account)

User General -> (Standard Account)

Is there a user group policy setting that I can enforce logging in from the Admin account (User A) such that, only User B can install new software on it? If not is there a mechanism to achieve this. I don't want to put any of these accounts on a domain.

Improve this question

1 Answer 1

Reset to default
1

Users can install any software that doesn't require admin privileges. This depends on the software installation, whether it allows you to choose between installing per-user or for all users. The first option shouldn't require admin rights.

Standard users can install any of these programs, for example Zoom and Teams. I think that Chrome would be in this list as well.

A well-built software installation would only ask for elevation once the user has selected the installation option "for all users". But there is no solution or GPO policy that can help with a software installation that asks first for elevation.

Improve this answer
4
  • In that case is there a way to prevent the General User from installing any software?
    – nikhil
    Commented Apr 19 at 11:21
  • 1
    I don't know of a method to prevent the installation of "per-user" software that doesn't require elevation. Portable installations which don't use the registry or protected folders are also not preventable.
    – harrymc
    Commented Apr 19 at 11:24
  • I think I found the solution to do so. answers.microsoft.com/en-us/windows/forum/all/…
    – nikhil
    Commented Apr 19 at 11:25
  • According to the comments that follow the first one, it doesn't work. I think it's mostly old policies.
    – harrymc
    Commented Apr 19 at 17:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .