Block users from installing or running programs in Windows 11/10

You can if you wish, restrict users from installing or running programs in Windows 11/10/8/seven as well as Windows Vista/XP/2000 & Windows Server family. You can do so by using certain Grouping Policy settings to control the behavior of the Windows Installer, prevent certain programs from running or restrict via the Registry Editor.

You may see an error message:

The installation is forbidden by arrangement policy, Contact your organization administrator

The Windows Installer, msiexec.exe, previously known every bit Microsoft Installer, is an engine for the installation, maintenance, and removal of software on modern Microsoft Windows systems.

In this mail service, we will see how to block installation of software in Windows 10/eight/7.

Disable or restrict the use of Windows Installer

Type gpedit.msc in start search and striking Enter to open the Group Policy Editor. Navigate to Computer Configurations > Authoritative Templates > Windows Components > Windows Installer. In the RHS pane double-click on Disable Windows Installer. Configure the option equally required.

This setting tin can prevent users from installing software on their systems or permit users to install only those programs offered by a organization ambassador. If y'all enable this setting, you lot tin can utilise the options in the Disable Windows Installer box to establish an installation setting.

The "Never" choice indicates Windows Installer is fully enabled. Users can install and upgrade software. This is the default beliefs for Windows Installer on Windows 2000 Professional, Windows XP Professional person, and Windows Vista when the policy is not configured.

The "For non-managed apps only" option permits users to install just those programs that a arrangement administrator assigns (offers on the desktop) or publishes (adds them to Add or Remove Programs). This is the default behavior of Windows Installer on Windows Server family when the policy is not configured.

The "Ever" selection indicates that Windows Installer is disabled.

This setting affects Windows Installer only. It does not prevent users from using other methods to install and upgrade programs.

Always install with elevated privileges

In the Group Policy Editor, navigate to User Configuration > Administrative Templates > Windows Components. Coil downward and click Windows Installer and configure it to E'er install with elevated privileges.

This setting directs Windows Installer to utilise system permissions when it installs any program on the organisation.

This setting extends elevated privileges to all programs. These privileges are normally reserved for programs that have been assigned to the user (offered on the desktop), assigned to the computer (installed automatically), or fabricated available in Add or Remove Programs in Control Panel. This setting lets users install programs that require access to directories that the user might not have permission to view or change, including directories on highly restricted computers.

If you disable this setting or do non configure it, the system applies the current user's permissions when it installs programs that a system ambassador does not distribute or offer.

This setting appears both in the Computer Configuration and User Configuration folders. To make this setting constructive, you must enable the setting in both folders.

Skilled users can have advantage of the permissions this setting grants to change their privileges and gain permanent access to restricted files and folders. Notation that the User Configuration version of this setting is not guaranteed to be secure.

TIP: Apply AppLocker in Windows to forbid users from installing or running applications.

Don't run specified Windows applications

In the Group Policy Editor, navigate to User Configuration > Administrative Templates > System

Here in RHS pane, double click Don't run specified Windows applications and in the new window which opens select Enabled. Now Nether Options click Show. In the new windows which opens enter the path of the awarding you wish to disallow; in this case: msiexec.exe.

This volition disallow Windows Installer which is located in C:\Windows\System32\ folder from running.

This setting prevents Windows from running the programs y'all specify in this setting. If you enable this setting, users cannot run programs that you lot add to the list of disallowed applications.

This setting just prevents users from running programs that are started by the Windows Explorer process. It does non preclude users from running programs, such as Task Manager, that are started past the system procedure or by other processes. Also, if you permit users to gain admission to the command prompt, cmd.exe, this setting does not preclude them from starting programs in the control window that they are not permitted to start by using Windows Explorer. Note: To create a listing of disallowed applications, click Evidence. In the Evidence Contents dialog box, in the Value column, type the application executable name (e.g., msiexec.exe).

Restrict Programs from beingness installed via Registry Editor

Open Registry Editor and navigate to the following key:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer\DisallowRun

Create Cord value with any name, like i, and set its value to the program's EXE file.

For example, If you want to restrict msiexec , then create a String value 1 and set its value to msiexec.exe . If y'all desire to restrict more than programs, then but create more String values with names two, 3, and and so on and set their values to the plan's exe.

Y'all may have to restart your computer.

Also read:

How to block EXE files from running using Group Policy
Windows Plan Blocker is a free App or Application blocker software to cake software from running
How to block third-party app installations in Windows.