[scs-04]

I have a domain network with about 25 XP workstations. Currently they are all local admin users. We want to try to stop them loading unapproved software and other junk. Can I remove the local admin rights and just make them a standard user? If they are set as a standard user will the Windows Updates still install without entering an admin password?? Also, what about Java and Adobe updates? What is the best way to handle this?

thanks

[DaveA]

If I remember right, a Standard (Limited) User can not do any updates including Windows, Office, AV and other protection programs.

[ETech7]

Using group policy you can remove all or logged-in user from local Administrators group and add domain admin to it. Windows updates runs as a system service so if fine with Windows deciding which updates to install you can just leave it as is. or you can (again through GPO) allow limited users to receive update prompts and act upon them without needing admin approval. Third party updates/installs will not be affected by that setting.

[scs-04]

When you say third-party installs/updates will not be affected do you mean they will still install fine?

[ETech7]

If they perform system wide changes - they'll require admin approval. Things which install into user's folder, like Chrome, will not need that.