How to limit or block the installation of programs in Windows 10

Limiting the applications we install from third parties is a good way to avoid malware since it is one of the most common forms of contagion. That is why you always have to be careful when installing it. Above all, when downloading it, so it is essential that it be from a reliable and secure page. In the event that our computer is used by more users, if they have the possibility of downloading programs, they may not be as careful as we can, so the risk of ending up infected increases.

It is no longer just the tedious task of having to delete applications that someone installed without our consent. But, in addition, we do not know what risks we face if the program is infected and how this can affect our computer. To avoid these problems, Microsoft introduced long ago in Windows the possibility of giving us greater control over the applications that we can or cannot install on our operating system.

Block application installation for security

In 2017 with the launch of Windows Insider, Microsoft introduced the possibility avoid installing apps that are not from the Windows 10 Store. Later, with the final release of Windows 10 Creators, this function allows us to both warn and block users every time they intend to install an application from unknown sources that are outside the Microsoft Store . Since then, this feature continues in all versions of Windows 10.

With this, Microsoft offered a full control to team administrators. Thus, they are in charge of deciding what type of applications they can install on the system. Thanks to this we can prevent possible infection with viruses from downloads made from dangerous websites. This is especially useful if we have a computer at work and we don’t want anyone else to be able to install applications on our computer. Likewise, if we have children at home who use the computer, we can prevent them from installing any program without our permission.

Limit the installation of programs in Windows

As we have mentioned before, if we share the computer with other users, we can prevent them from installing third-party applications from any web page. To do this, we can limit your download exclusively to those made from the Microsoft Store. In this way, we can greatly avoid the possibility of being infected by viruses or malware. This is something we can do from the Windows Settings menu, from the Local Group Policy Editor or from the Registry Editor.

From the Configuration section

To proceed with this program installation block, we must access the Windows 10 Configuration section. We can access it quickly by pressing the keyboard shortcut “Windows + I”. Once the new «Settings» window appears, click on the Applications option.

Once the new window appears at the top, we find the option “Choose where you want to get the applications from.” Just below we find a drop-down menu from which we can choose what type of applications can or cannot be installed in the operating system. By default it is marked as the “From anywhere” option. If we mark it, we find that we have four options available:

• Anywhere: As its name suggests, we will not find limitations when installing applications on our Windows 10 computer, having total freedom to download it from anywhere and install it.
• Anywhere, but let me know if there are any comparable apps on the Microsoft Store: similar to the previous one, in the sense that we can continue downloading and installing any application wherever it comes from. However, in this case, the system will notify us in the event that there is a comparable application within the Microsoft Store, in case we prefer to install it from there in a more secure way.
• Anywhere, but let me know before installing an application that is not in the Microsoft Store
  : again we have the possibility to continue installing any program on our computer regardless of its origin. But this time the system will warn us every time we try to install an application that is not within the Windows Store itself, alerting us to the possible dangers that it carries. In addition, it will show us a warning with the possible risks that we assume and that we must accept.
• Microsoft Store only (recommended): here we find the most restrictive and at the same time safest option to prevent downloading applications that may contain viruses or malware. In this way, the download is restricted exclusively to the applications found within the Microsoft Store. All these applications hosted on Microsoft’s servers are virus-free, so their installation is completely safe.

In view of the options we have, the most recommended if we want to avoid at all costs that other users can install third-party applications externally is to select the option of only Microsoft Store.

From Local Group Policy Editor

Another option we have to block the installation of third-party applications externally is to do it from the “Local Group Policy Editor”. To do this, we must access this tool using the keyboard shortcut “Windows + R”, which will be in charge of launching the “Execute” command. Next, we must write gpedit.msc and click on the “Accept” button or directly Enter.

Once the window with the Editor appears, we go to the “Equipment Configuration” section. Subsequently, we double click on the “Administrative Templates” section. Next, we select “Windows Components” and “Windows Installer”. Here, in the right panel, we must look for the entry «Prohibit user installations».

We double click on it so that a new window appears we mark the box of Enabled. At the bottom we will have a drop-down tab where we must choose the option to “Hide user installations”. When selected, the installer ignores the applications per user. This causes the applications installed per machine to be displayed to users, even if those users have a per user installation of the product registered in their user profile. Finally, click on the “Apply” and “OK” button so that the changes are saved and close the editor.

From this moment on, any user other than the administrator of the equipment will have the installation of all kinds of applications on the computer blocked.

From the Registry Editor

Finally, we can establish the possibility of blocking the installation of applications using the “Registry Editor”. Of course, we must take into account that any modification that we make that is not correct can cause failures in the stability of the system. Therefore, we must use it with caution and at our own risk.

To access we must press the keyboard shortcut “Windows + R” to access the Run tool. Here we write regedit and we press the “Accept” button or the Enter key.

Once in the Editor, we must navigate to the following path:

HKEY_LOCAL_MACHINE / Software / Classes / Msi.Package / Defaultlcon

Once here we must double click on the default value that we find within that registry key. This will open a small window. In it we must modify the value and replace 0 with 1. This will disable Windows Installer, which will prevent anyone from installing applications on our computer. To remove the restriction, we will only have to carry out the same steps and replace the 1 with 0 again.