Locking down NT User Groups/file permissions/preventing users installing ANY software

[N1ckR]

Is it possible to change/create different user groups in Windows NT/2K/XP ?

I would like to prevent users from installing ANY software. Currently (default) user group can install software that does'nt change system settings.

Also, could anyone thing of reasons why I could'nt lock down the execute folder permissions of users to only the folders they need execute from ?

[Infinity]

here you can find info about group policies

http://www.petri.co.il/working_with_group_policy.htm

Win2000 : http://www.comptechdoc.org/os/windows/win2k/win2kgpolicies.html

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/lsm_overview_01.mspx

{QUOTE-> If you are using WinXP Pro go to Start>Run type: gpedit.msc
Navigate to Computer Configuration>Admin Templates>Windows
Components>Windows Installer>Disable Win Installer.
+ Prohibit User Installs <-QUOTE}

[N1ckR]

Thanks, I found lots of info on the default groups in windows, but nothing on changing them, just what I needed.