eric inazaki wrote:

Supposedly a user (not a power user but a plain user) can't
install software but apparently this isn't completely true
(I, as a user, was able to load Google Chrome among others).

Generally speaking, what kinds of software can be installed
by a user, how porous is this restriction mechanism?

Is there some kind of policy setting that can tighten up
this restriction?

Is there a way to audit software installs?

Thanks in advance,
eric

The user only need to copy files into a folder in which they have been
granted execute permission. This is why, for example, Google Earth can
"install" under a limited account because its installer copies the files
under the %userprofile% path and runs from there because execute
permissions are granted on those folder, and also why some admins will
change the permissions for the %userprofile% (and all child objects
thereunder) to remove execute permissions.