Group Policy Security to set the LogMeIn account

[XDvir]

Hi there,

The Group Policy provided by LogMeIn is great to have. It is really a need to control the access within the corporate to strong service like LogMeIn.

However, I couldn't find a very required value on the Group Policy and this is the LogMeIn account to be used for any LogMeIn product on the computer.

We are using the LogMeIn for management and support reasons, but still need a security solution to prevent the user from changing the account on his computer or even uninstalling LogMeIn and then reinstalling it with private account. The corporate account should be kept in the AD and every LogMeIn product should look there for the account to be used.

Do you know of any way this can be done already? I just think it must be there already, since the rest of the AD Group Policy is well done and documented and this feature is quite simple and yet very powerful.

Thanks,

Dvir

[Sean]

Unfortunately, the prevention of uninstalling can only be done through Windows permissions.  Specifically removing the end-users' rights to install software on there own, or making them non-admins.

Preventing a user from moving the computer to another account can be done through the GPO we provide by ensuring that the user that is logged in has only the Access Rights they need.  Generally this is all Login, File Manager, and Remote Control permissions.  Always couple this with a Domain Admin that has full rights to the software.

[XDvir]

Thanks, but I didn't only want to cover the computers which have LogMeIn installed but also the ones we didn't yet get to.

By forcing specific account directly from the AD, we can prevent all users from loading their own accounts.

Unfortunately sometimes the corporate environment does require giving Local Admin permission to a user, due to some purely developed software that are required for the work framework of the employee.

Having AD sorting the account of LogMeIn, even if Admin rights are given, they will only add the computer to the specific account, once installed LogMeIn on it.

Is there an option to do so or does it sound like something that would be viable to request?

Thanks,
Dvir 

[Sean]

Unfortunately, that would not be possible.  Once removed the registry keys that register it to your account are removed.  When they install at that point, they can attach to their own account.

You could try pushing the install via GPO, then setting a software restriction policy.  I beleive that the GPO push will override the restriction, but prevent installs by any other method.