Allow or Block User App Installs via Registry

In Windows, system administrators can regulate whether standard (non-administrative) users can install applications by configuring specific values in the Windows Registry (Regedit). The primary registry values governing this behavior are DisableMSI, located under the Windows Installer policy path, and ConsentPromptBehaviorUser, located under the User Account Control (UAC) policy path. Adjusting these DWORD values enables you to restrict installations entirely, restrict installations strictly to administrators, or enforce credential prompts.

1. The Windows Installer Setting: DisableMSI

The primary registry setting that directly controls whether standard users can run Windows Installer (.msi) installation packages is DisableMSI.

• Registry Path:
  HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
• Value Name:
  DisableMSI
• Value Type:
  REG_DWORD

Value Data Options:

• 0 (Default): Windows Installer is fully enabled. Standard users can install applications that do not require administrative elevation.
• 1: Windows Installer is restricted to administrators only. Standard users are blocked from running installation packages.
• 2: Windows Installer is disabled completely for all users, including administrators.

2. The UAC Elevation Setting: ConsentPromptBehaviorUser

To prevent standard users from attempting installations or modifications requiring administrative privileges (such as .exe setup files), configure the User Account Control elevation policy.

• Registry Path:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
• Value Name:
  ConsentPromptBehaviorUser
• Value Type:
  REG_DWORD

Value Data Options:

• 0: Automatically denies elevation requests. When a standard user attempts to run an installer that requires administrative rights, the system immediately blocks it without prompting for credentials.
• 1 (Default): Prompts the user to enter an administrator’s username and password on the secure desktop to proceed with the installation.

3. Elevated Privileges Setting: AlwaysInstallElevated

Windows also includes a setting that allows standard users to run installations with elevated (SYSTEM) privileges, though it is generally not recommended due to security risks.

• Registry Paths:
  HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer
  and
  HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
• Value Name:
  AlwaysInstallElevated
• Value Type:
  REG_DWORD

Value Data Options:

• 0 (Default): Standard users cannot install packages with elevated system permissions.
• 1: Grants standard users the ability to run .msi installations with full administrative/SYSTEM privileges (both HKLM and HKCU keys must be set to 1 for this to take effect).

How to Apply the Settings in Regedit

1. Press Win + R, type regedit, and press Enter.
2. Navigate to the target registry key path (e.g., HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer). If the Installer subkey does not exist, right-click Windows, select New > Key, and name it Installer.
3. Right-click the right-hand pane, select New > DWORD (32-bit) Value, and name it (e.g., DisableMSI).
4. Double-click the newly created DWORD, set the Value data to your preferred setting (e.g., 1 to restrict to admins only), and click OK.
5. Restart the computer or run gpupdate /force in the Command Prompt to apply changes.