Please, I was wondering how may can I block normal Domain Users from installing software but I can install using Administrators accounts (it's just like needs elevation before install) using GPO's?

I have already tried the Windows Installer policy but it disallow all users from installation including Admins!

using GPMC ==> administrative TEmplates==> Windows Components ==> Windows Installer ==> Prohibt Windows Installer ==> Enabled

  • Isn't that the default behavior? – Esa Jokinen Dec 27 '18 at 9:52
  • 1
    Windows Installer policy is not effective for applications that don't use Windows Installer. – Greg Askew Dec 27 '18 at 12:31

If you are using an Enterprise edition of Windows, you can implement AppLocker, specifically Windows Installer rules.

However, users without admin privileges can, by default, only install software on their user account (not computer-wide).

  • This may help but it does far more than just blocking software installations. But I would recommend it to lock down the system. – Andreas Rehm Dec 27 '18 at 22:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.