0

My system has windows 10 pro installed on it and I want to prevent software installs.

I tried disabling the windows installer using gpedit but it didn't work(I was still able to install softwares without any problem).

I don't want to create more than one user account to solve this.

  • If you don't trust the software someone might be installing on your PC then you shouldn't be trusting that person with whatever personal details (email, etc.) that might be in, or accessible from, your account. – Mokubai Jan 21 '17 at 8:55
  • Just lower your privilege level, i.e. remove yourself from the administrator group. Beware, you'd need to access the (normally hidden) administrator account to undo this. – jiggunjer Jan 21 '17 at 9:02
  • @jiggunjer "Hidden administrator" is disabled, not hidden. Windows will not allow to remove administrator from administrators's group if there no any other enabled administrators account(s). – Alex Jan 21 '17 at 9:17
  • @Alex I know, but I didn't say to remove Administrator from the administrator group, I meant removing Rahul . – jiggunjer Jan 21 '17 at 9:19
  • @jiggunjer No, it isn't possible. System's "Administrator" account is disabled by default on all systems since Vista, 7, 8, 10. One can enable it, set password on it and use it as I suggested in my answer, but it wouldn't satisfy OP request to have only one login account. – Alex Jan 21 '17 at 9:33
2

My answer obviously will not answer your question but I will try to explain why it is useless attempt:

This - "I don't want to create more than one user account to solve this." is the most common error. No one educated administrator would work on computer under administrator's account. It used only for administrative tasks, such as program installations or adjusting settings for the whole computer.

If there only one account, it is means it is administrator's account and if somebody has access to it then he/she can revert all of your restriction attempts. It isn't applied to a real humans only, but it applies to a viruses too. If they runs under administrator account, - it isn't your computer anymore.

  • Actually "If there only one account, it is means it is administrator's account" is not precise, the administrator user is often hidden, allowing the user to lower their privileges to normal user. – jiggunjer Jan 21 '17 at 9:00
  • @jiggunjer The only difference between hidden "administrator" and the user who set in control panel->users as administrator it is passwordless UAC. If user will lower it status to a normal (to be correct - standard) user then it isn't administrator anymore. You can't be in jail and live outside of it in the same time, otherwise it isn't a jail. – Alex Jan 21 '17 at 9:12
  • You can actually log in to Windows using the Administrator user account. Whether UAC is enabled isn't really important. They are two distinct users. When you install Windows with a single user you actually have 2 users. – jiggunjer Jan 21 '17 at 9:15
  • @jiggunjer Your experience coming from Windows XP age. You can't login to system's administrator account when it is disabled since Vista. – Alex Jan 21 '17 at 9:22
  • It's true I haven't messed around with this in a while. But I remember enabling it in Windows 7 one time. – jiggunjer Jan 21 '17 at 9:23
2

You can’t. Even a regular user without any privileges can still install programs to their user account folder.

Well, actually, you can: You need a whitelist of programs that are allowed to run. It must of course not include any user-writable path. This will prevent the user from running anything, including installers. However, maintaining it is a major PITA.

The Windows Installer service is only concerned with .msi packages. Many programs don’t use them, because creating them is rather complex.

  • But it still obfuscation. If one know the system and the only user on computer is administrator then anything done by admin can be reverted except unrecoverable damage that can be done with admin account rights easily – Alex Jan 21 '17 at 20:07
2

You have already received two "You can't" and "it is useless" answers below. But I lean towards more practical solutions than technically correct answers.

But first, this answer applies only if you have Windows 10 Enterprise edition. Microsoft makes good features only available to those who pay more money.

Do the following in the order given:

  1. Create one admin account that only you know its password. Create a standard user account that others use. (And maybe yourself too. What stops you after all?) Users with the standard user account cannot install apps into C:\Program Files folder.
  2. Using the admin account, enable Applocker to prevent the standard user account from installing apps outside C:\Program files. Excerpt from "Preventing Standard Users from Running Per-user Applications". TechNet. Microsoft:

    To prevent standard users from running per-user applications

    1. To open the Local Security Policy MMC snap-in, click Start, type secpol.msc, and then press ENTER.
    2. In the console tree, double-click Application Control Policies, and then double-click AppLocker.
    3. Right-click Executable Rules, and then click Create Default Rules.

    Three rules are created and listed in the MMC details pane:

    • Allow all users to run files in the default Program Files folder.
    • Allow all users to run files in the Windows folder.
    • Allow members of the built-in Administrators group to run all files.
  3. Using the admin account, disable Windows Store. Excerpt from "Disable access to, or Turn off Windows Store in Windows 10/8.1". The Windows Club:

    1. Type gpedit.msc in Run box and hit Enter to open the Local Group Policy Editor
    2. Navigate to the following setting: Computer Configuration → Administartive Templates → Windows Components → Store
    3. Here, in the right pane, you will see the setting Turn off the Store application. Double-click on it to open the Settings box, select Enabled and clicked Apply.
  • "Create one admin account that only you know its password. Create a standard user account that others use." - it can be done on home version too – Alex Jan 21 '17 at 20:11
  • @Alex ROFL! You do know that it is insufficient, right? Far too insufficient. But if doing that alone floats your boat, then enjoy! ;) – user477799 Jan 22 '17 at 5:43
  • I just trying to correct a little misleading information when you said: "But first, this answer applies only if you have Windows 10 Enterprise edition" :) I believe you will agree that it isn't correct since one can create extra admin account on home version. Anything else, yes, it true, M$ likes $$$ – Alex Jan 22 '17 at 8:59
  • 1
    @Alex My, dear, there is an English word for what you are doing right now: "Nitpicking", which means "to be excessively concerned with or critical of inconsequential details." It doesn't matter if a tiny part of the whole solution applies to all editions. The entirety of the solution does not. – user477799 Jan 22 '17 at 11:34
  • 1
    @Alex It appears you are thinking I have posted three solutions, one of which works on all editions of Windows. You are wrong. I have posted one solution consisting of three steps, all of which must be carried out on a copy of Windows 10 Enterprise edition. – user477799 Jan 23 '17 at 5:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.