A ban on the installation of programs by a certain user can be caused by a variety of reasons. The task can be solved by standard means of the Windows operating system, but it should be borne in mind that, with a certain level of knowledge, any prohibitions can be bypassed.
Instructions
Step 1
The most common recommendation to prevent a specific user from installing programs is to create a separate limited account for the selected user. After that, using secpol.msc (Local Security Policy), you need to allow this user to use only applications located in the% SystemRoot% and% ProgramFiles% folders, disallowing all others.
Step 2
To do this, uncheck the LNK file type in the Software Restriction Policies - Designated File Types group and select the All users except local administrators parameter in the Enforcement section. After that, go to the Security Level section and specify the Disallowed option as the default parameter.
Step 3
The vast majority of users use the built-in installer to install a new application. Therefore, blocking the Windows Installer program can serve as an alternative way to prevent installation. This can be done by creating a new DWORD string parameter named DisableMSI in the appropriate branch of the system registry. Possible values for this parameter are:
- 0 - All users are allowed to use Windows Installer.
- 1 - only the system administrator is allowed to use Windows Installer;
- 2 - All users are prohibited from using Windows Installer.
Step 4
Try also to register programs to which you want to deny access to a specific user in the branch
HKEY_CURRENT_USER / Software / Microsoft / Windows / CurrentVersion'Policies / Explorer / DisallowRun, creating a new REGSZ parameter for each application. The value of the parameter being created must be the full path to the program executable file. Also create a new parameter of type REGDWORD with a value of 1 lkz to prevent execution of the selected program.
