Disable font installation for non-admins?

Hi all,

I'm trying to figure out a way to disable regular users from installing fonts on some computers that I am an administrator on for work. I've searched around quite a bit, but no luck. Any thoughts?

Thanks!
Brian

Change the NTFS permissions on the Fonts directory so that the local Users group (and any others you want restricted) do not have Write Permissions.

1. Open My Computer and navigate to the following directory.

   C:\Windows\

2. Right-click the Fonts folder and choose Properties.
3. In the Fonts Properties dialog box, select the Security tab.
4. Under the Group or user names: heading, select the user or group that you wish to restrict.
5. Enable the check box next to Write in the Deny column. This will adjust other permissions as necessary to restrict writing to the directory.
6. Click Apply and OK to close all open dialogs.

Users without Write permissions on the Fonts folder cannot install system fonts.

Thanks a lot Nilpo for the obviously well-thought-out response. I had actually planned on that originally, but my boss (work project; I work for my school) is afraid of other students using other folders (Adobe system folders, for instance) to skirt the issue. Do you have any ideas for that?

The main reason for this is that we reimage these computers relatively frequently, and don't want someone to download a font for a posting (the main purpose of these computers), save it with that font on the network drive, have the computer be reimaged, then lose the font. (which would probably be true on many, many documents). There are already about 250 fonts installed, and another department on campus does just fine with those (they do pretty similar things).

Thanks again!

Edit: My coworker just had an idea to have a policy on the hard drive not to allow creating new .ttf files, which I think would be our best bet. I'm going to look into how to do that, but if you have any ideas I'm all ears (er, eyes)

Why not just disable the use of all local drives and force them to save only to the network? This is pretty typical of kiosk systems.