Manage Install Rights with Group Policy Settings
Select the Windows icon in the lower left corner of your screen and type ''gpedit.msc'' into the search bar. Hit Enter to open the Group Policy Editor. Once that opens, follow the path ''Computer Configurations'', then ''Administrative templates'', followed by ''Windows Components'' and finally ''Windows Installer''. In the RHS pane box you must then double-click on ''Disable windows installer''. Configure the option as per your needs. If you activate this setting, you can use the options in the Disable Windows Installer box to choose which of the three installation settings you desire.
The “Never" setting means that Windows Installer will let anyone install anything. This is the default for Windows Installer unless you reset user privileges manually.
The “For non-managed apps only" option permits users to install only those programs that a system administrator assigns (offers on the desktop) or publishes (adds them to Add or Remove Programs). This should be the setting that employers should have on all employee workstations, as it will only permit your employees to install programs that have to do with their jobs.
The “Always" option indicates that Windows Installer is disabled.
Sounds easy, right? Wrong. These settings only affect programs using windows installer. Programs installing via other means or that come as fully executable files will still be able be downloaded and installed. So the only way to be completely sure is to disable the program you want to block through the registry editor. Group Policy Settings are relatively blunt software installation security tools for most users, although if you are a parent it can be useful for only granting privileges for approved programs for your kid's user accounts.