Ultimate Guide: Master the Art of Blocking App Installation on Windows PCs

Key Takeaways

You can block installing new apps by creating a standard user account or limit app installs to Microsoft Store, and you can also prevent these settings from being altered.

To enhance control over app installations, it is possible to utilize the Group Policy Editor for blocking the installation of executables, including MSI files. Alternatively, you may consider employing third-party applications like Install-Block or Deep Freeze.

Are you interested in preventing individuals from installing new applications on your Windows PC? Rest assured, you are not the only one. Fortunately, there are numerous methods available to achieve this on Windows 11, Windows 10, or earlier versions. Let's explore these options.

Why Block Installing Apps on Windows?

Every user could have their own conditions and use cases. However, the general reasons to block installing new apps or programs may include:

You don't want your children to install new apps when using your computer.

You don't want your employees to install external apps or programs on their work PCs.

Enhancing your Windows machine's security, it is advisable to resist installing new apps as it may put your system at risk.

This precautionary measure prevents the possibility of harmful Windows apps being installed from any source.

How to Block Users From Installing New Apps on Windows

We've outlined several methods for stopping app installations on Windows, and you can pick the most appropriate method for your use case. Let's start with the most basic method.

1. Creating a Standard Account

When setting up a user account on a Windows PC, you have the option to assign specific privileges and permissions to each user. We recommend creating a Standard User Account for our purposes. With this type of account, anyone accessing the machine through it will be unable to install new applications without entering the administrator's PIN code. This method is compatible with Windows 11, 10, and older versions, and is a straightforward approach.

The first step is to access the "User Accounts" settings page, and the easiest way to do so is to press Win+R to launch the Run app, then type netplwiz and press Enter.

After opening the User Accounts window, click on the "Add" button and choose the "Sign in without a Microsoft account" option. This is recommended for our situation as it allows for easier management of a local account.

A confirmation window will appear. Proceed by clicking the "Local Account" option.

Please input your desired name, password, and password hint. Please remember that the name and password will serve as your login credentials for the new account. Once you have provided this information, click on "Finish".

In the User Accounts settings, locate the recently created user. Choose the user by clicking on it and then click the "Properties" icon. Lastly, ensure that the user is set as a standard user.

After restarting your PC, you can easily log in to this new account. Alternatively, just open the start menu and click on your photo to find the option for switching to a different user on Windows without the need to restart or sign out. If you later attempt to install a new app, you will be prompted to enter the administrator PIN code, which is usually the same as your user password.

2. Limiting Apps Installs to Microsoft Store

An alternative method is to restrict the installation of apps or programs on your Windows PC only to those sourced from the Microsoft Store. This approach enhances security as the majority of apps available on the Microsoft Store are already verified as safe to download. It is important to note that the Microsoft Store now offers regular apps such as Firefox or Opera, thus providing users with a wider range of options beyond Universal Windows Platform (UWP) apps. Moreover, this method is compatible with both Windows 11 and 10.

One disadvantage, though, is that the PC user can disable this option without any authentication. Fortunately, we can address this issue by making a simple edit to the group policy.

To begin, access the Settings app by either pressing Win+i or navigating to it in the usual way. Then, proceed to the "Apps" section and choose "Advanced App Settings."

Through the "Choose Where to Get Apps From" drop-down menu, select "The Microsoft Store Only."

To ensure that this option cannot be changed in the future, you will need to make modifications in the Group Policy Editor. Please note that the Group Policy Editor is only accessible in the Pro versions of Windows. To proceed, open the Group Policy Editor by searching for it within Windows Search (or by pressing Win+R and typing "gpedit.msc"). Next, navigate to the following path:

Computer Configuration\Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer

Double-click on the "Configure App Install Control" policy and choose "Enabled." Next, go to the "Options" drop-down menu and select "Allow Apps from Store Only." Lastly, click on "Apply" followed by "OK."

Please restart your PC to apply the changes. When you revisit the "Advanced App Settings" page, you will notice that the option is now disabled and cannot be modified. Remember, if you wish to re-enable it, you must undo the group policy edit you recently performed.

3. Block Installing Executables Through Group Policy Editor

While most executable files are typically in EXE format, it is possible to prevent the installation of MSI files. Although not a complete solution, this method can be used alongside other approaches to restrict app installations. It is important to note that it does not prevent the installation of EXE files.

Access the Group Policy Editor and locate the specified path, which is similar to the one mentioned earlier.

Just double-click the "Turn Off Windows Installer " setting and choose "Enabled," then set it to "Always." Finally, click "Apply" and/or "OK."

Upon completion of the aforementioned task, an error message will appear stating "The system administrator has implemented policies to prevent this installation" when attempting to install any MSI executable. To activate these modifications, it is necessary to restart your device.

Within the current "Windows Installer" folder, locate the policy named "Allow User Control Over Installs." Once found, simply double-click on it and select the "Disabled" option. By doing so, users will be unable to execute installation files as well.

As previously stated, Group Policy Editor is exclusively accessible for Windows Pro versions. To achieve the same outcome, you can utilize the Registry Editor instead. Begin by initiating the Registry Editor. You can do this by pressing Win+R, typing regedit, and then pressing Enter. It is crucial to ensure the safety of your registry by creating a backup before making any modifications.

Then, navigate to the following path (or copy and paste it).

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Msi.Package

Finally, double-click the "Default" key, change the value data to

C:\Windows\System32\msiexec.exe,1

After that, restart your PC.

4. Try a Third-Party App to Block Installs

To avoid system modifications, you can opt for a third-party app to accomplish the task. Install-Block, priced at $19.95, is the most favorable choice.

Install-Block functions by identifying a specific keyword set by you in window titles. Once the keyword is detected, it will block the window and prompt for a password. For example, you can select "Install" as the keyword, given that almost every software installer includes this word in its window title.

Feel free to download and test out the Install-Block demo. However, please be cautious as this software interprets things quite literally. For instance, if you happen to have a webpage with the word "opened" in it (similar to this one), the application will interfere and prevent access due to its identification of the term "install" within the browser's window! Nonetheless, you have the option to customize exceptions within the application's settings.

Instead, you can give Deep Freeze a shot. It is a paid tool but offers a 30-day trial period. Unlike Install-Block, Deep Freeze permits users to install any desired programs, but upon device restart, everything reverts back to its original state.

Now you're all set. Looking to enhance the security of your PC? Take a look at our guide on basic computer security to optimize your everyday PC usage!