I'm installing a new computer to a small domain network, with a sbs 2003 server.
This computer should only be used to view 4 different web pages, and open and edit a few word documents.
(read: I don't want people to install programs on it or surf all over the net.)
I have almost reached this goal, IE is sat to view the correct web pages, and no other, and the user is a guest users on the computer which I though would remove the users chances to install applications.
However: Firefox is my "test" application, and it to easy to install this.
I have blocked it from being installed to c:\program files\ assume this was done by using the guest account, but you can still install it to root (or my documents if you want to), removing write to root prevented the installation there, but My documents wouldn't be wise place to remove the write access.
I have tried to edit the hklm\software rights so the user have deny access to make sub-values and ad keys, but again, it looks like firefox avoid this allso.
I have never made a policy, but I guess that is the road I have to travel.
The other computers at the network have there users sat up as local administrators, and they have to have free access to install applications etc