How to prevent users from installing software

by Mitch Tulloch [Published on 17 April 2007 / Last Updated on 17 April 2007]

Preventing users from installing software.

Users love to install stuff on their computers—I’m thinking Google toolbar, Yahoo toolbar, Skype and so on. Unfortunately many business don’t want users to be able to do this because if installing such software should destabilize their systems, support costs will escalate. What are some of the ways you can try to prevent users from installing software on their computers?

First, make sure users are ordinary users and not members of the Power Users or Administrators local groups on their machines. This should always be your first line of defense. Second, you can implement software restriction policy using Group Policy to block specific executables or msi files from being run on targeted users’ machines. Third, you can block users from accessing the websites where they can download such software by configuring your perimeter firewall/proxy server. And fourth, you could implement mandatory user profiles.


Mitch Tulloch was the lead author for the Windows Vista Resource Kit from Microsoft Press, which is THE book for IT pros who want to deploy, maintain and support Windows Vista in mid- and large-sized network environments. For more about Mitch, visit his website

The Author — Mitch Tulloch

Mitch Tulloch is a widely recognized expert on Windows administration, networking, and security. He has been repeatedly awarded Most Valuable Professional (MVP) status by Microsoft for his outstanding contributions in supporting users who deploy and use Microsoft platforms, products and solutions. Mitch has published over two hundred articles on different IT websites and magazines, and he has written or contributed to almost two dozen books and is lead author for the Windows 7 Resource Kit from Microsoft Press. For more information, see .

Latest Contributions

Featured Links