You can prohibit per user installs of MSI packages using the policy at computer config\admin templates\windows components\windows installer\prohibit user installs. Since this is a per computer you would need to apply it at the computer of the user(s) you want to restrict. Alternatively, if you really needed to button things down, you could set up a Software Restriction Policy "white list" where only a known set of applications and setup packages are allowed to run. This would guarantee that *nothing* runs outside of what you know about. Of course, all this gets harder if your users are local admin on their workstations. Darren _____ From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Jason A. Varley Sent: Wednesday, August 23, 2006 2:20 PM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Restricting only Software Installations This may have a simple answer but I can't think of it at the moment. How can I restrict only a users ability to install software? I know some policies and user groups would probably encompass this restriction but I was wondering how to do just the one restriction of installing software. Is this possible?? Thanks for the help! Jason