3 Ways to Block New Software Installations in Windows 11

If you want to keep a Windows 11 PC more secure and easier to manage, preventing users from installing new software can make a big difference. This is especially useful on shared family PCs, office computers, classroom devices, and kiosks where you want to limit unwanted apps, toolbars, and potentially risky programs.

Windows 11 gives you a few different ways to do this, depending on how much control you need and which edition of Windows you are using. Some methods are simple and flexible, while others are stronger but more restrictive.

1. Use a Standard User Account Instead of an Administrator Account

The simplest and often most effective way to stop software installs is to make sure everyday users are not administrators. Standard accounts can use the computer, browse the web, and run many apps, but they usually cannot install system-wide software without an administrator password.

1. Open Settings and go to Accounts > Other users.
2. Select the account you want to limit.
3. Change the account type from Administrator to Standard User, if available.
4. Create a separate administrator account that only trusted people can use for software installs and system changes.

2. Block Installers with Local Group Policy

If you have Windows 11 Pro, Enterprise, or Education, Local Group Policy is one of the strongest built-in ways to stop users from running installers. This method can restrict Windows Installer packages such as MSI files and reduce the chance of users adding software without permission.

1. Press Windows + R, type gpedit.msc, and press Enter.
2. Go to Computer Configuration > Administrative Templates > Windows Components > Windows Installer.
3. Open Turn off Windows Installer and set it to Enabled.
4. Choose Always if you want to block Windows Installer completely.
5. Optionally, review other software restriction settings in the same area to tighten control further.
6. Click Apply, then OK.

You can also use Software Restriction Policies or AppLocker, depending on the edition of Windows and how strict you want the control to be. These tools can block specific file types, folders, or apps, which is helpful if you want to prevent not only MSI installers but also executable setup files.

3. Restrict Which Apps Can Run Using App Control or Software Restrictions

If your goal is not just to stop installers, but to stop unknown programs altogether, app control is the best long-term option. This approach is especially useful in managed environments where you want to allow only approved software.

• AppLocker: Lets you allow or deny programs based on publisher, path, or file hash.
• Software Restriction Policies: A more basic built-in option for limiting which executables can run.
• Windows Defender Application Control: Best for tightly managed environments, but more advanced to configure.

With these methods, users may still download setup files, but Windows can prevent them from running. That makes them more effective than simple download restrictions, because many programs can be launched from a browser download or extracted folder if execution is not controlled.

1. Open the relevant policy tool for your Windows edition.
2. Create rules that allow only trusted folders, publishers, or file hashes.
3. Block execution from user-writable locations such as Downloads or Desktop if appropriate.
4. Apply the policy and test it with a non-critical app before locking down the system fully.

Extra Ways to Reduce Unwanted Installs

A few additional settings can help reduce accidental or unwanted installations, even if they are not as strong as policy controls.

• Disable Microsoft Store access if you do not want users installing Store apps.
• Use Family Safety or managed accounts for children’s PCs.
• Remove saved administrator passwords from everyday user accounts.
• Limit browser-based downloads if the PC is used in a controlled environment.

Which Method Should You Use?

For most home users, converting the account to a standard user is the best first step. It is simple, built into Windows 11, and blocks many common installs without making the PC difficult to use.

For stronger control, especially on Pro, Enterprise, or Education editions, use Local Group Policy, AppLocker, or Software Restriction Policies. These methods are better when you need to prevent users from bypassing the normal install process or running unauthorized software from downloads and removable media.