Sure, there's lots of things you can do to make it inconvenient for them to install it, but a local admin has all the rights of a domain admin on that particular box, which is all rights.
-----Original Message----- From: Angus Scott-Fleming [mailto:angu...@geoapps.com] Sent: Monday, December 07, 2009 5:19 PM To: NT System Admin Issues Subject: Re: IE8 On 7 Dec 2009 at 14:42, David Lum wrote: > > If users are local admins can I realistically block IE8 from getting > installed? You *_can_* block "automatic updates" from installing it: Toolkit to Disable Automatic Delivery of Internet Explorer 8 http://is.gd/5fn3o- To help our customers become more secure and up-to-date, Microsoft will distribute Windows Internet Explorer 8 as a high-priority update through Automatic Updates for Windows XP Service Pack 2 (SP2) and higher, Windows XP Professional x64 Edition, Windows Server 2003 SP2 for x64 and x86, Windows Vista for x64 and x86, Windows Vista SP1 for x64 and x86, and Windows Server 2008 for x64 and x86. This Blocker Toolkit is intended for organizations that would like to block automatic delivery of Internet Explorer 8 to machines in environments where Automatic Updates is enabled. The Blocker Toolkit will not expire. If you have EXE-whitelisting in place you might be able to block it since the installer isn't whitelisted, but I don't know about blocking an MSI install. -- Angus Scott-Fleming GeoApps, Tucson, Arizona 1-520-290-5038 +-----------------------------------+ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
