Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to prevent clickonce installers from being run from Internet explorer. For example, google chrome is installed through a clickonce installer.

Is this possible? If so what are the options to disable it? I'm only concerned with Windows 7.

share|improve this question
Is this something you want to do through Group Policies or on a per machine basis? – John Gardeniers Oct 25 '11 at 21:18
I don't think you can. You can disable Windows Installer in Group Policy (with or without a domain), but users can still install software using other installers. You can give a user only "Standard" rights, and they can't install a program to Program Files or use an Installer that puts components in c:\Windows, but they can install applications like FireFox and DropBox into the AppData folder. – Dom Oct 26 '11 at 0:42
@John Gardeniers: Either solution is acceptable. – Nathanael Oct 26 '11 at 5:59

Use Applocker.

We've implemented AppLocker with a baseline set of default rules that allow items to be run from program files, windows and some outside folders (like a custom folder for users to put portable apps). This removes the ability for clickonce junk to install as they most of the time launch from the profile.

Not only does this assist keeping clickonce off our computers and out of user's profiles...but it basically stops drive by malware in its tracks.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.