How to prevent users from adding Software Packages to the Software Installation settings of a GPO? (4220459)

A Protected Settings Policy (available in version 5.8 and later) can be used to prevent GPOs with the specified settings from being deployed. To use a Protected Settings Policy to prevent users from creating GPOs with the Software Installation settings configured:

1. Open the GPOAdmin console
2. Expand the GPOAdmin node
3. Right click the first node (domain name) and select Properties
4. Select the Options tab
5. Check Enabled Protected Settings for Group Policy Objects
6. Click OK
7. Right click the Protected Settings container and select New | New Protected Settings Policy
8. Provide a name for the policy
9. Select the domain and click Next
10. Select a template if you want to use one and click Next
11. Click Launch Editor
12. Under Computer Configuration or User Configuration (depending on your needs) expand Policies | Software Settings
13. Right click Software Installation and select New | Package
14. Select a small software package that is OK to install on all workstations. The Software installation setting has to be populated with a value to be able to prevent any other GPO from having a value populated.
15. Select Assigned and click OK
16. Close the Group Policy Management Editor
17. Click Finish
18. Right click the new Protected Settings Policy and select Check In
19. Expand the Version Control Root, right click the container where you want the Protected Settings Policy applied and select Properties
20. Select the Protected Settings tab
21. Click Browse and select the Protected Settings Policy you want to use and click OK
22. For the Validation rule select Values other than those defined in the Protected Settings Policy are not allowed
23. Select any GPOs that you want excluded
24. Click OK