prohibit local user from installing software

June 3, 2018 at 14:56:57
Specs: Windows 10, AMD Turion 2.4GHz/4GB RAM
I am inquiring a way to prevent other local users from installing software on my personal PC. I obvious have my own admin rights over my own PC but my son also has a local non admin account on it. He is constantly downloading and installing software without my permission and its slowing my computer down, in addition to the security risks with just installing random programs. I want to prevent his user account ONLY (still allowing my account) from being able to install any software. I technically know how to do this using group policies, but am just more familiar with this in an actual AD domain environment, and not so much on a single non-AD local level.

To my understanding I would need to configure the Computer configuration - Windows Components - Windows installer policy, but would that not just prohibit for all users, as described being for the entire computer? There seems to be no equivalent setting on the user level. And furthermore, for each user level setting, how would I link that rule to any specific user and not other?

See More: prohibit local user from installing software

June 3, 2018 at 15:51:19
From the admin account you make sure that his account is listed as a user and it should then require an admin password to allow installing programs. It has always worked this way. There also may be additional options from the admin accounts page for user accounts in Windows 10.

You have to be a little bit crazy to keep you from going insane.

Report •

June 4, 2018 at 05:55:52
OK, he does have a "user" type account and I just tested to try to install something under his account and it did prevent me. However a few weeks ago, he somehow still managed to download/install this game when no permissions have changed since. It was a web game that perhaps needed a plugin or "background software" installed that perhaps bypassed this restriction.

Just for kicks and giggles, going back to my original question about setting a group policy on his account. How would I be able to assign certain policies to his account only (including software installation in addition to other policies I may want to set)?

Report •

June 5, 2018 at 12:47:45
Okay, a few observations and replies.

1) How would I be able to assign certain policies to his account only?
Same way you'd troubleshoot group policy, but in reverse. Dump the policy's verbiage into Google, add "registry key" to the search, and then add that key to his registry hive.

2) ...including software installation?
Oh, you can't stop that. You can prevent Windows Installer from doing its job, but nothing stops him from throwing down an .exe file somewhere. Nothing prevents him from copying the supporting files to the same location. Nothing prevents him from adding some keys to his registry (optional). Probably why so many program installers don't bother using Windows Installer.

3) [H]e somehow still managed to download/install this game
Just to his profile? Lots of shady software (and Chrome) try to bypass UAC by only installing themselves to the user's profile. This technically means you can just delete his profile to clean the PC. Just make sure to save a copy of anything he wants to keep.

4) There seems to be no [Disable Windows Installer] setting on the user level.
Correct. It's an all-or-nothing proposition. You can also just disable the "Windows Installer" service. Expect Windows patching to break.

How To Ask Questions The Smart Way

message edited by Razor2.3

Report •

Related Solutions

June 5, 2018 at 17:15:19
I found when my kids were growing up I set rules/guidelines for computer behavior. Then when they got a little older, they got their own computers which they were responsible for. When they got into trouble (infected machines, bogging down so they could not do anything, etc), I cleaned them out and went over their responsibilities to avoid junk and do regular maintenance so they learned to manage their systems and responsibilities.

You have to be a little bit crazy to keep you from going insane.

Report •

Ask Question