How can I prevent Opera GX Browser being installed by Domain users?


  1. Posts : 196
    Windows 10 Pro
       #1

    How can I prevent Opera GX Browser being installed by Domain users?


    Just like the title states. I think this seems to only be allowed for Chrome-based browsers but I'm not sure, but my Domain users are able to run the Opera GX Browser installer and install this browser. Other EXEs don't work (which is intended). Some other Chrome-based browsers like WaveBrowser can also be installed.

    How can this be prevented?

    The server is Windows 2019, we use GPMC.
      My Computer


  2. Posts : 1,337
    Windows 10
       #2

    Block the exe for OperaGX by linking it.
      My Computer


  3. Posts : 2,220
    Windows 11 Pro (latest update ... forever anal)
       #3

    If the user Windows logon account is set to Standard, they shouldn't be able to install anything ?

    EDIT Well I'll be jiggered. I knew that Opera had an option to be able to install for current user only or all users. It appears that Opera (and maybe others) will automatically install for single users, irrespective of Windows logon account status (Standard or Admin)

    Consequently, you may have to resort to a Group Policy Editor setting (which should be available as an admin, domain based installations require Windows Pro)

    GPEdit > Computer Configurations > Administrative templates > Windows Components > Windows Installer > enable Turn off Windows Installer

    EDIT 2 Nope, sorry, still doesn't stop "local" (logged on user only) installations. It's effectively being installed (the same) as a portable program
    Last edited by idgat; 04 Jun 2024 at 23:04.
      My Computers


  4. Posts : 7,042
    22H2 64 Bit Pro
       #4

    You can try the attached REG file. I cannot post the contents as this forum blocks some of the code so I have zipped it.



    Image showing file contents:

    How can I prevent Opera GX Browser being installed by Domain users?-docpad.jpg

    Other that that it is suggested to use AppLocker or GPO to lock down OperaGX install paths in AppData in the user profile but I don't know much about that.

    Interestingly you might try ExecutePrevent to whitelist existing software and lock down Appdata.

    UVK Help - Execute Prevent

    You'd need to install UVK per user and password protect it. (Password protection is in options)

    It doesn't need to remain running or to launch on boot because it modifies/ creates GPO's

    If you have access to a single machine for testing purposes than maybe try it.
      My Computer


  5. Posts : 874
    Windows 10 Pro
       #5

    Is this in a business environment? If so a stern warning letter would be a start.
      My Computer


  6. Posts : 9,790
    Mac OS Catalina
       #6

    Build a script that installs and update policies, utilize third party offerings that will help you manage the policies/MDM.
      My Computer


  7. Posts : 196
    Windows 10 Pro
    Thread Starter
       #7

    Callender said:
    You can try the attached REG file. I cannot post the contents as this forum blocks some of the code so I have zipped it.



    Image showing file contents:

    How can I prevent Opera GX Browser being installed by Domain users?-docpad.jpg
    If you rename the file, then that would break that regedit, right? I'm 100% sure that if that's the case, kids would figure this out.
      My Computer


  8. Posts : 7,042
    22H2 64 Bit Pro
       #8

    Correct. Renaming would bypass the restriction.
    .
      My Computer


  9. Posts : 1,337
    Windows 10
       #9

    You will have to make a powershell script that will update the policy.

    you link the exe or what ever the file is by hash it should work by its hash value, it would mean that the file won't be able to install by them based of its hash. You would just download the opera file to %temp% using wget or curl then make the script edit/redefine the policy based off of the new data. Renaming the file won't effect the hash and then just have it delete the file or clear temp folder from script.

    You would have the script check periodically because when the developer updates Opera then the hash will change. That would be the easy way but you can also get the hash of a file too without downloading that file.
      My Computer


  10. Posts : 7,042
    22H2 64 Bit Pro
       #10

    JOSHSKORN said:
    If you rename the file, then that would break that regedit, right? I'm 100% sure that if that's the case, kids would figure this out.
    Rethink: Modify the reg file and substitute launcher.exe with OperaGXSetup.exe

    (Replace OperaGXSetup.exe with launcher.exe)

    It will then install but will not be able to run.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 20:16.
Find Us




Windows 10 Forums