Prevent users from installing software in Windows 10, 8, 7

Whether you manage company computers or don’t want your children playing around with your computer, preventing them from installing software in your Windows isn’t hard. Many programs installed can degrade your computer’s performance or worse a huge security risk that cripples your system. Fortunately, there are a lot of techniques to prevent users from installing software in Windows 10, 8 and 7.

Prevent users from installing software in Windows via Local Group Policy Editor

We can use Group Policy Editor to disable the Windows installer. This is the simplest way to prevent software installation.

  1. Go to Start Menu, In the Search box,Type in’gpedit.msc‘ (without quotes) and the Group Policy Editor box should appear.
  2. Go to Computer Configurations > Administrative templates > Windows Components > Windows Installer.
  3. In the right-hand side pane, look for Turn off Windows Installer, double-click it. Then select Enabled in the top pane.
    The description in the information window next to it tells you that enabling this will “prevent users from installing software on their systems”.
  4. Select an option in the bottom pane, you can choose from ‘For non-managed applications only’, ‘Always’ or ‘Never’.
  5. Select OK.

‘For non-managed applications only’ means users can only install programs assigned to the desktop by the administrator. ‘Always’ disables Windows Installer altogether while ‘Never’ means it is enabled for all users.

Loading...

Prevent running specific Windows Applications via Local Group Policy Editor

Still using Local Group Policy Editor,  however, in this method we will specify which application to block from running into Windows.

  1. Go to Start Menu, In the Search box,Type in’gpedit.msc‘ (without quotes) and the Group Policy Editor box should appear.
  2. Go to User Configuration > Administrative Templates > System. In the right-hand side pane, look for Don’t Run Specified Windows Applications. As the title implies, this is used for preventing certain programs from being executed, therefore we can also block the Windows Installer using this method.
  3. Double-click that and another window appears. When you click Enabled, a new option appears called List of Disallowed Applications. Click Show and a third window appears where you type in the location of the program to be blocked. Now, you’re going to add the Windows Installer Program which is called msiexec.exe and is found at: C:\Windows\System32\msiexec.exe Copy and paste that into the space provided in the box and click OK. The Windows Installer should now be blocked.

Prevent software installation via Registry Editor

We will use a very important Windows component called Registry Editor or regedit.

  1. Click on Start Menu, In the Search box, type regedit and press Enter.
  2. Click Yes when User Account Control window asks you a permission to perform changes to your computer.
  3. Go to HKEY_LOCAL_MACHINE\Software\Classes\Msi.Package\DefaultIcon.
    To do this double-click the folder to navigate inside the registry editor.
  4. Right-click, choose Edit and change the 0 to a 1 to disable Windows Installer.

Prevent any Program from running into Windows via Registry Editor

  1. Click on Start Menu, In the Search box, type regedit and press Enter.
  2. Click Yes when User Account Control window asks you a permission to perform changes to your computer.
  3. Go to HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer\DisallowRun
  4. Create a new String value with any name, e.g. 1 and set its value to the program’s EXE file.

Suppose you want to restrict rstrui.exe, then create a String value 1 and set its value to rstrui.exe. If you want to restrict more programs, then simply create more String values with names 2, 3 and so on and set their values to the program’s exe.

Note: Registry is a very critical part of Windows operating system so make sure only change the part I have specified to avoid any problem.

Third party options to prevent users from installing software in Windows 10, 8, 7

If you’re uncomfortable playing around with your Windows settings, then there are a variety of options to get the job done for you. Here are some third-party softwares that you could use.

Install-Block

Plan: Paid, Free Trial Period
Website: http://bashsoftware.net/

As you can see in the screenshot, the Install-Block program continuously monitors running applications then if the application’s window title matches “install”, “setup” or “license agreement”, it will be blocked.

InstallGuard

Plan: Free
Website: http://www.completelock.com/

It says on their website: “Blocks all installations from starting on your system without your authorization, including Microsoft Installer (msiexec), InstallShield and all other commercial installers. You can also block custom processes (executables) from being executed on your system…” To use InstallGuard (which won’t be discussed here) you should read their help guide first to maximize its potential and to avoid any unwanted result. Visit their website provided above.

WinGuard Pro

Plan: Paid, 30 Days Free Trial
Website: http://www.winguardpro.com/

WinGuard Pro is pretty straightforward, to block something, open the program, go to Program Lock tab, then click Lock Program. A list of open apps will then appear in a box and you would choose the one you want locked. Obviously “Unlock Program” reverses that.