Blocking cracked software

I have approximately 75 employees all on Windows XPsp2 in an Active Directory domain environment. These employees don't seem to grasp the concept of why cracked software doesn't belong in the workplace. So I figured like any good solution I will just throw money at it. Can anyone recommend some good software that can monitor applications installed on the end users machine and or possibly block cracked software? Also if anyone has any other good ideas on how to solve this issue I will except that too. Thanks.

break thier fingers...(joking)

Remove them from the local administrator group...they wont be able to install software.

Write an Acceptable Use Policy...and threaten dismissal if violated

Use group policy to lock down the machines

"There are to technical solutions to adminstrative problems"

MLF

A simple solution may be to lower the employees rights so the they can't install software.

Cheers:

I cant think of anything but I like DjM's idea :-)

MLF has the only correct solution :)

Preventing them from installing anything is the way to go.
This will also protect your users (to an extend) against malware.

These are great solutions to the problem and if you are looking for software i use SIW http://www.gtopala.com/ this will show what software is running on the computers. But like they said it before, permissions and user restrictions are your best solution. With the right group policies you can knock this out in no time.

Also, lock all floppy, CD and USB drives. Prevent downloading of files from Internet completely, only allow necessary attachments in emails and block all mails greater than a certain size.

stop access to 'run' command
deny ALL attachments in outlook, you can always grab some from filter if really required
it is best to set a 'deny all' policy, then to fine tune it to allow certain 'trusted' senders
rather than an 'allow all' where YOU have to check everything

use of group policy is THE way to go
set it onto the PC's too

set up a bunch of groups, with each having certain permissions set, drop users and their PC into the required group

it is easiest to do it from a group level, as micro managing everything is impossible once you get above just a dozen persons

even the military recognise this
each level up / rank, has 'power' over those lower, and those immediately lower number around a dozen

general talks to his colonels
colonels talk to their captains
captains talk to their sergeants
sergeants talk to their infantry troop

you get the picture

generals do not need to talk to troops

hell, even jesus could only man manage a dozen disciples :p :D

and definately get an AUP up abd running
to be signed by all
and to be adhered to

@ joshmobile:

It sounds as if you have inherited the proverbial can of worms?

I guess the way to go is:

1. Determine a Security Policy. Here, you look at who needs what to do their jobs. The secret is to give them exactly that..............no more, no less ;)

2. Determine an Authorised Useage Policy that supports your Security Policy.

3. Look at your software and hardware solution options to implement and monitor #1 and #2. You have lots of good stuff above :)

I don't know your precise environment, but I will suggest that you look at a few more ideas that were not fully developed earlier in this thread.

1. Beware the dreaded laptop. You need to look at those very carefully, particularly as they tend to be issued to relatively senior and trusted personnel. I would personally require that if they are taken offsite they be audited and scanned on their return, and before they can access your network. IME senior management frequently have offspring that have bred true to type :lildevil:

2. NO! absolutely NO! P2P............... not never, notime!

3. Content/IP filtering............ if they really need those sites, let them come and ask. Foxy~ was getting at that with his comments on "really required".

4. Try to resist wireless until you are happy you can secure yourself as well as you can against USB devices.

5. Proxies?............ reading your personal e-mail at work? I don't think so?

6. Social Interfacing (read "engineering" for that)............. nope.

7. Mail attachments can be an issue............ maybe some people need them........... look for a system that quarantines them so the recipient has to come and ask.......... that is a great deterrent :cool:

Just a few thoughts to be going on with................