How can it be proven that users cannot install software to their local machine without having local-admin privileges?

The system owners are able to view the GPO and show that the only groups with access to BUILTIN\Administrators are domain\Domain Admins and domain\CustomAdminGroup, but are unable to provide any evidence that the ability to install software is restricted to that group. Is there a configuration that enforces this restriction or a configuration that says the corollary (non local admins cannot install software)?

Alternatively, is there documentation from Microsoft that says Software installation privileges are inherently only available to the Local Administrators?

  • 2
    Pay attention to the difference between downloading software, running software, and "installing" software. – grawity May 30 '18 at 13:34
  • Non admins are able to download the package and download the .exe prompt, but when trying to install, it fails and triggers an error prompt. I updated the question with the requested clarification. – BostonJomo May 30 '18 at 13:41
  • What is the prompt that users get? – EBGreen May 30 '18 at 14:15
  • "you do not have sufficient privileges to complete this installation for all users on this machine. Log on as an administrator and retry this installation." I do not know if that is a custom prompt or native. – BostonJomo May 30 '18 at 14:23
  • @BostonJomo - It is not a custom prompt. That is the standard Windows Installer prompt. Please note the group policy that handles this behavior only prevents software being installed via a Microsoft Installer executable (.MSI). Most software can be ran on a system, as a user, without being installed. Downloading and running the application would be possible in a case like this. If you want to prevent software like that from being downloaded, use content filtering, at the firewall level. – Ramhound May 30 '18 at 15:13

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.