How to Block Users for Installing Software on Your Windows Computer

Whether you have a company network, or simply a computer used by various household members, it can be really annoying — or a huge security risk — if anyone is allowed to install software on the computer. All it takes is for one virus-ridden program to get onto a network-linked computer, and suddenly you will have multiple botnets chanting “Resistance is futile….prepare to be assimilated!” at anyone who tries to destroy it.
Another scenario where blocking software from being installed is essential is personal security. Imagine if somebody tried to install key-logging software on your computer to see what you have been typing, or to capture your login details for various sites? Pre-blocking new software from being installed will stop those attempts in their tracks.

Since the best treatment is prevention, we are going to take a look at some ways in which you can stop people from installing onlinesexystrippoker.exe. Trust me, you’ll thank me later.

Native Windows Solutions

The following methods look intimidating to anyone who dislikes fiddling around under the hood with their Windows setup. But quite honestly, it is really easy. Just follow along with me here. I won’t lead you astray.

Local Group Policy Editor

Go to your Start Menu and type in:

gpedit.msc

This brings up something called the Local Group Policy Editor. Now go to Computer Configurations > Administrative Templates > Windows Components > Windows Installer.

In the list in the right-hand window, scroll down until you find Turn off Windows Installer. The information window next to it will inform you that enabling this will “prevent users from installing software on their systems”. That’s the one we’re looking for.
When you double-click that option, another box will pop up, and you just have to choose Enabled, then press OK. All done. To reverse the process, just double-click the option again and choose “Disabled”.

Don’t Run Specified Windows Applications

Another way to block the Windows Installer from being used can be found in another area of the Local Group Policy Editor.
Go back to the main menu in the Policy Editor window, and now go to User Configuration > Administrative Templates > System. In the right-hand window which now appears with options, scroll down until you find Don’t Run Specified Windows Applications. As the title implies, this is used for blocking certain programs from being run, but we can also use it to block the Windows Installer.

Double-click that and another window appears. When you click Enabled, a new option appears called List of Disallowed Applications. Click Show and a third window appears where you type in the path of the program to be blocked.
Now note I said “path”. That means it is not sufficient to just say “Windows Installer”. You have to lay out the route to the location of the Windows Installer, so the Policy Editor can find it. The Windows Installer Program is called msiexec.exe and is located at:

C:\Windows\System32\msiexec.exe

Copy/paste that into the space provided in the box and click OK. The Windows Installer should now be blocked.

Restrict via the Registry Editor

Aaggh! The Registry! The one Windows word which is guaranteed to send shivers down peoples spines. Nobody likes going in here, as it’s got things going on that I can’t rightly explain. Things that go bump in the night, and all that.

But we need to embrace our fears, so hang on. We’ll get through this together.
The first step (after arming ourselves with crucifixes and garlic cloves) is to do the key combination Windows key + R. In the Run box, type:

regedit

This will bring up the Registry Editor. Calm down and stop screaming. It won’t bite you.
Now use your mouse to navigate to:

HKEY_LOCAL_MACHINE\Software\Classes\Msi.Package\DefaultIcon

In the right-hand window which now appears, you’ll see the path to the Windows Installer, with a zero on the end. That zero implies that the Installer is allowed. To disable the Installer, just click on that line, and in the box that now pops up, change that 0 to a 1. Save and close. Installer blocked.
Well done. You survived the Registry!

Software Options

I know there are other Windows options, such as elevated privileges or using the Local Security Policy. But I decided I would focus on the 3 easiest options instead, and not overload you. But if you still don’t feel comfortable messing around with your Windows settings, then another option would be to install software that gets the job done for you. Maybe it’s just me, but I find it ironic that you need to install software to block software!
Here are three options which I tried – one free and two paid (with free trial periods) – and which lock your system down tighter than a baby’s bottom.

WinGuard Pro

Plan: Paid, 30 Days Free Trial
From what I can see, WinGuard Pro is more geared towards locking down areas of the computer to other users. So for example, if you are the system administrator at work, you may want to block access to the Registry Editor by other users in the network. Or blocking “Programs & Features” would stop people from getting into the list of installed apps and uninstalling anything.

To block something, you would bring it up on the screen, then click Lock Program. A list of open apps will then appear in a box and you would choose the one you want locked. Obviously “Unlock Program” reverses that.

Install-Block

Plan: Paid, Free Trial Period
This stops anything from being installed by looking out for certain keywords in apps running on your system. So if someone tries to install something, and a keyword is noticed, Install-Block automatically blocks it from going any further.

So as you can see in the screenshot, keywords can include “install”, “setup” or “license agreement”. What other words could we add? “Terms & Conditions”, maybe? “Freeware”?

InstallGuard

Plan: Free
InstallGuard does its job really well — to the point where I couldn’t figure out how to shut it down and uninstall it afterwards! I finally figured out that you have to sign into the app with the administrator password, then click File >Exit. That shuts it down and you can then uninstall it if you want.

If you are looking for somethingreally effective that works right out of the box, this is the one. For me, it blocked EVERYTHING from being installed — and I was logged in as the administrator! You can’t argue with the price, either.

Deep Freeze

One final intriguing option is one proposed by Joe back in January, i.e. “deep freezing” your computer, which resets your system back to a previous state every time you reboot it. This way, any changes made to your computer will be wiped out when rebooted. So if someone dares to install something, it will be deleted when you switch the computer off.

The only downside to this of course is that it will also wipe out your changes. So it is not perfect.