How to prohibit making any software changes on the PC?

Question

System administration

It is necessary to prohibit any software changes on the PC without a physical key. What is it called to explain to the system administrator? And how is it carried out? It is necessary to avoid installing any viruses and questionable software components. Will it help against installing malware or not at all?

Answer 1

This is called key authorization.
Of our developers, here are these, although there are a bunch of them
https://www.aladdin-rd.ru/catalog/jacarta
About help will not help.
The administrator needs to do a few other things:
1. Keep all computers up to date
2. Prohibit the launch of programs not from the white list
3. Create access groups with certain rights for users
4. Remove / update programs that require admin privileges
5. The owner of the office should create internal rules order and distribute signed by employees.
6. After that, the built-in Windows antivirus will be enough to prevent all threats
7. Invest in courses for employees on the topic "Digital Hygiene on the Internet and Common User Mistakes"

Answer 2

This is called kiosk mode.

Answer 3

The question is not so much technical as organizational and legal. Although of course there is something that can be done.
- If there is a domain, the extra users / bots from the Domain Admins group, fuck it, if there is no domain - the same from the Administrators group on each computer.
- For each user - according to a standard account, no administrator rights for secretaries
- Compile and implement a white list of programs for each workplace, all unnecessary software - fuck
- UAC, Windows Defender and antivirus (with a constantly updated database) - in a combat rack.
And organizationally - you can draw up and bring under the signatureeach a certain document, which will be said about the fact that it is impossible to open links in the left mail and about the fact that installing programs is the task of the administrator, and the rest is not fig. Or even not one document, but several.

Answer 4

It is necessary to prohibit any software changes on the PC without a physical key

This is a hardware platform that checks the presence of a key before starting the computer. Buy the platform and install.

What is it called to explain to the system administrator?

Trusted Platform Module (TPM)

It is necessary to avoid installing any viruses and questionable software components.

Yes, this can easily be done with standard OS tools (Windows, Linux). Just wondering what this has to do with your question? What do hardware keys have to do with it, and how is it connected?

Will it help against installing malware or not at all?

Using a hardware key does not affect the possibility of virus infection and malware installation in any way.

Answer 5

Alternatively, this is called SZI from NSD, for example Dallas lock (in any case, it can do this)

Answer 6

back to options above
+ light: don't give users admin rights