Prevent Users From Installing Software in Windows 10

This guide shows you how to stop standard users (and sometimes even administrators) from installing software on a Windows 10 PC. You’ll learn methods ranging from simple group policy settings to more advanced registry edits, and what to do if a user still manages to get something installed.

What You’ll Need

• An account with administrative privileges on the Windows 10 PC.
• Access to the Group Policy Editor (gpedit.msc) – available on Windows 10 Pro, Enterprise, or Education editions. If you have Home edition, you’ll need to use the Registry Editor method instead.
• Basic familiarity with navigating Windows settings and the Registry Editor (use caution when editing the registry – back it up first).

Step-by-Step

Method 1: Using Group Policy (Pro/Enterprise/Education)

1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Installer.
3. Double-click the policy Prohibit User Installs.
4. Set it to Enabled. In the options, choose Hide user installs to block all installs for non-administrators, or Show user installs to allow only per-user installs that don’t affect other users. For maximum blocking, choose Hide user installs.
5. Click OK and close the Group Policy Editor.
6. Restart the computer or run gpupdate /force in Command Prompt to apply the policy immediately.

Method 2: Using Registry Editor (All Editions)

1. Press Win + R, type regedit, and press Enter.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer. If the Installer key doesn’t exist, right-click on Windows, select New > Key, and name it Installer.
3. Right-click on the Installer key, select New > DWORD (32-bit) Value, and name it DisableUserInstalls.
4. Double-click DisableUserInstalls and set the value data to 1 (this hides all user installs). Click OK.
5. Close the Registry Editor and restart the computer.

Method 3: Using Standard User Accounts (Best Practice)

1. Create a standard user account for each person who should not install software. Go to Settings > Accounts > Family & other users.
2. Click Add someone else to this PC, then follow the prompts. When asked, select Add a user without a Microsoft account and create a local account.
3. After creation, select the account and click Change account type. Set it to Standard User.
4. When a standard user tries to install software, Windows will prompt for an administrator password. Without it, the installation is blocked.

Method 4: Disable Installation Sources (App Store and Web)

1. To block Microsoft Store installs, go to Settings > Apps > Advanced app settings (or Apps & features), and choose Anywhere or Store only under “Choose where to get apps�. Selecting Store only prevents sideloading of non-Store apps.
2. To block web downloads, use Group Policy to restrict the default download location or set up a firewall rule to block executable downloads. A simpler approach is to use a standard user account and set Internet Explorer/Edge to prompt for admin credentials when downloading executables.

Method 5: Using AppLocker (Pro/Enterprise)

1. Open Local Security Policy (secpol.msc) or AppLocker via gpedit.msc under Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker.
2. Create an Executable Rules policy that denies all executables for standard users, then create allow rules for specific programs you want to permit.
3. Enable the rules and they will apply immediately to all users.

Common Mistakes

• Forgetting to restart or run gpupdate – Group Policy changes may not take effect until the computer restarts or you run gpupdate /force.
• Only blocking .exe files – Users can still install software via .msi, .bat, .cmd, or PowerShell scripts. Ensure your policy covers all executable types.
• Not testing with a standard account – If you test with an admin account, the policy may not appear to work because admins bypass many restrictions.
• Disabling Windows Installer entirely – This can break legitimate software updates and system repairs. Use the “Prohibit User Installsâ€� policy instead of disabling the service.
• Editing the registry incorrectly – A wrong key or value can cause system instability. Always back up the registry before making changes.

Tips

• Use the Standard User approach as your primary defense – it’s the simplest and most effective for most home and small business environments.
• Combine Group Policy with AppLocker for a layered defense: block all installs by default, then allow only approved software.
• Regularly audit installed software by checking Settings > Apps > Apps & features to ensure nothing slipped through.
• If you need to allow specific users to install certain software, create a separate policy for them or use AppLocker’s “Allowâ€� rules for those users.
• Keep Windows 10 updated to ensure security patches don’t conflict with your policies.

Troubleshooting

• Policy not working: Run gpupdate /force and restart. Check if the policy is applied by running rsop.msc (Resultant Set of Policy) to see which policies are active.
• User can still install via portable apps: Portable apps don’t use the Windows Installer. Use AppLocker to block executables from writable folders like the user’s Downloads or Temp directories.
• User gets an error but can still install: Ensure the “Prohibit User Installsâ€� policy is set to “Hide user installsâ€� – “Show user installsâ€� still allows per-user installs.
• Registry edit doesn’t work: Double-check the path and value name. The value must be a DWORD (32-bit) named exactly DisableUserInstalls.
• AppLocker rules not applying: Make sure the Application Identity service is running. Go to Services (services.msc), find “Application Identityâ€�, and set its startup type to “Automaticâ€�.

Frequently Asked Questions

Can I prevent users from installing software without using Group Policy?

Yes, you can use the Registry Editor method (DisableUserInstalls) or simply give users standard accounts. Both work on all Windows 10 editions.

Will these methods block Windows Updates?

No, blocking user installs does not affect Windows Updates. System updates are installed by the system service and will continue to work.

Can I allow certain users to install software while blocking others?

Yes, with AppLocker you can create rules that apply to specific users or groups. Alternatively, you can give those users administrator passwords, but that’s less secure.

What if the user is an administrator?

Administrators can bypass most of these restrictions. To block administrators, you’d need to remove their admin rights or use more advanced security policies like Software Restriction Policies, which is beyond the scope of this guide.

Does this work for Windows 10 Home?

Group Policy Editor is not available on Home, but the Registry Editor method and standard user accounts work fine.

Can I reverse these changes later?

Yes, simply set the Group Policy to “Not Configured� or delete the registry value, then restart. Standard user accounts can be changed back to administrator at any time.

Related

• Check Whether Software Supports the Ryzen AI Max GPU
• Fix Windows Install Error 0x80300024
• How to Use AI at Work Without Losing Core Skills