Prevent users from installing software in Windows 10, 8, 7

Whether you manage company computers or don’t want your children playing around with your computer, preventing them from installing software in your Windows isn’t hard. As a matter of fact, too many programs installed can degrade your computer’s performance or worse a huge security risk that cripples your system. Fortunately, there are a lot of techniques to prevent users from installing software in Windows 10, 8 and 7.

Prevent users from installing software in Windows via Local Group Policy Editor

We can use Group Policy Editor to disable the Windows Installer. This is the simplest way to prevent software installation.

Go to Start Menu. In the Search box, type in’gpedit.msc‘ (without quotes) and the Group Policy Editor box should appear.
Go to Computer Configurations > Administrative templates > Windows Components > Windows Installer.
In the right-hand side pane, look for Turn off Windows Installer, double-click it. Then select Enabled in the top pane.
The description in the information window next to it tells you that enabling this will “prevent users from installing software on their systems”.
Select an option in the bottom pane, the options are ‘Always’, ‘For non-managed applications only’ and ‘Never.’ ‘For non-managed applications only’ means users can only install programs assigned to the desktop by the administrator. ‘Always’ disables Windows Installer altogether while ‘Never’ means it is enabled for all users. Therefore, ‘Always‘ is the best option.
Select OK. To test if it works, try to run a Windows Installer package (usually in a msi file extension). It should display an error message “The system administrator has set policies to prevent software installation.“

Prevent running specific Windows Applications via Local Group Policy Editor

In this method, you’ll still use the Local Group Policy Editor, however, you need to specify which application to block from running into Windows.

Go to Start Menu, In the Search box, type in’gpedit.msc‘ (without quotes) and the Group Policy Editor box should appear.
Go to User Configuration > Administrative Templates > System. In the right-hand side pane, look for Don’t Run Specified Windows Applications. As the title implies, this is used for preventing certain programs from being executed, therefore we can also block the Windows Installer using this method.
Double-click that and another window appears. When you click Enabled, a new option appears called List of Disallowed Applications. Click Show and a third window appears where you type in the location of the program to be blocked. Now, you’re going to add the Windows Installer Program which is called msiexec.exe and is found at: ‘C:\Windows\System32\msiexec.exe‘. Copy and paste that into the space provided in the box and click OK. The Windows Installer should now be blocked.

Prevent software installation via Registry Editor

This time, you will use a very important Windows component called Registry Editor or regedit. Take note that Registry is a very critical part of Windows, so make sure to follow the following steps very carefully and change only the part I have specified to avoid any problem. Needless to say, backup your Windows first.

Click on Start Menu, In the Search box, type regedit and press Enter.
Click Yes when User Account Control window asks you a permission to perform changes to your computer.
Navigate to the following key:
```
HKEY_LOCAL_MACHINE\Software\Classes\Msi.Package\DefaultIcon
```
To do this double-click the folder to navigate inside the registry editor or simply copy-and-paste this key into the input box just below the menu bar.
On the right side, Right-click (Default), choose Edit and change the 0 to 1 to disable Windows Installer (msiexec.exe).

Finally, restart your PC to allow this change to take effect.

Prevent any Installer Program from running into Windows via Registry Editor

Follow the steps below very carefully as you will use Registry Editor again in this tutorial.

Click on Start Menu, In the Search box, type regedit, and press Enter.
Click Yes when User Account Control window asks you permission to perform changes to your computer.
Again, before proceeding, make sure that you strictly follow the steps below or else, you might end-up crippling your Windows.

In the Registry Editor. Go to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\

In the left pane, right-click on Policies, then select New > Key, type in Explorer and press Enter. If the Explorer key already exists, just skip this step.
Now, select the Explorer key on the left pane. Right-click an empty area on the right side, select New > DWORD (32-bit) Value.
Rename the newly created item to DisallowRun, then double-click it and change its value to 1.
Right-click on the Explorer key on the left pane, then select New > Key, type in DisallowRun and press Enter.
Select the DisallowRun key on the left pane, then right-click on a blank area and select New > String Value.
Create a new String value with a number 1 and set its value to the program’s EXE file you want to block. If you want to add more programs to block, just create more String entries with names 2,3,4 and so on with a corresponding installer’s filename as value.
Finally, log-off or restart your PC to allow these changes to take effect. This time, when you open a blocked program, you’ll receive an error message “This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.”

Third-party options to prevent users from installing software in Windows 10, 8, 7

If you’re uncomfortable playing around with your Windows settings, there are a variety of options to get the job done for you. Here are some third-party softwares that you could use.

Install-Block

Plan: Paid, Free Trial Period
Website: http://bashsoftware.net/

As you can see in the screenshot, the Install-Block program continuously monitors running applications then if the application’s window title matches “install”, “setup” or “license agreement”, it will be blocked.

InstallGuard

Plan: Free
Website: http://www.completelock.com/

It says on their website: “Blocks all installations from starting on your system without your authorization, including Microsoft Installer (msiexec.exe), InstallShield and all other commercial installers. You can also block custom processes (executables) from being executed on your system…” To use InstallGuard (which won’t be discussed here) you should read their help guide first to maximize its potential and to avoid any unwanted result. Visit their website provided above.

WinGuard Pro

Plan: Paid, 30 Days Free Trial
Website: http://www.winguardpro.com/

WinGuard Pro is pretty straightforward to use. To block something, open the program, go to Program Lock tab, then click Lock Program. A list of open apps will then appear in a box and you would choose the one you want to be locked. Hence, you should add all installer programs into the list. One of these is obviously Windows Installer or msiexec.exe.