This post will focus on a painful one, and this problem will be very familiar to many people. Installing some kind of toy, or mail of an agent, along with this, a bunch of software is installed that you did not plan to install. First of all, we will talk about Mail.ru, and about other companies that behave arrogantly towards their users.
For a long time already, unflattering reviews and opinions have been circulating about the Mail.ru group of companies, about their aggressive and dishonest (often illegal) marketing, not only in relation to competitors, but also, first of all, in relation to users. Once again, they brought me a laptop for cleaning from this shit, and I realized that it was enough to endure this lawlessness, in the form of a hidden installation of govnosoft.
Blame the damned Guard and Downloader from Mail.ru(you can also add there Satellite from Mail.ru). The point is that these supposedly "useful" (according to the developers) programs behave in no way other than malware. In short: you decided to install an agent for yourself, download, install, and here the most interesting thing happens - in addition to the agent itself, a bunch of unnecessary poop is installed on your favorite computer: satellite, toolbar, guard, etc. etc. According to representatives Mail.RU, if you uncheck these programs when installing the main program, then they will not be installed. NONSENSE!!! In fact, this is not always the case. This is evidenced by a great many angry remarks, reviews and reviews on this matter. (Read habrahabr)
But the main trump card of mail.ru is [email protected] (like Defender). In fairness, it should be noted that it, of course, protects: from unauthorized change of the browser start page, for example, or from unauthorized change of the search engine. But this is the whole hitch, he almost without the knowledge of the user sets the start page (guess which one?), And now protects from changing it (even if the user does it on purpose). Also with default search. Moreover, not only protects, but also removes all previously installed modules from Yandex, Rambler etc. And we remember that we did not agree to install this software. Here is such a destructive activity as a result of the wonderful company Mail.RU. It would seem, and to hell with it, a useful function on the one hand. But the fact is that when remove Guard, he magically returns again. And everything is yours start page again Mail.ru.
Anyone who is even a little familiar with information security has probably seen the malicious nature of all these actions, typical of viruses and Trojans, for example:
- installation without the knowledge of the user;
- changing user settings without the knowledge of the owner;
- uninstalling third-party applications;
- inability to remove by standard means of the operating system.
But even that is not all! The tiniest bit is ahead.
As it turned out, Mail.RU has one more application - [email protected] (Loader). And now this is, in my opinion, real malware (Article 273 of the Criminal Code of the Russian Federation) from the side of this company. The thing is that, for example, an Internet user is walking through various resources on the network, looking for the necessary information, and then bang - a notification pops up that you need to update Skype, Opera, Mozilla, Chrome, Internet Explorer, etc. , and it all looks quite official. BUT! The download does not come from the official site, but from the mail.ru partner sites, and, of course, not the update is downloaded, but “ Internet browser"(Apparently the last creative person died in Maily) all from the same Mail.RU! Naturally, with its own toolbar and other govnosoft from the above, such as [email protected].
Familiar situation? Yes, for me!
You may ask, why don't antiviruses block or swear? And here's why: all these pseudo updates are signed by a real and legitimate digital signature of Mail.Ru! Therefore, antiviruses, analyzing this signature, quite naturally trust the downloaded and running application.
And now tell me, isn't this fraudulent? Not cheating users? Not misleading? But this is the lyrics.
We didn't start it
This is how the Mail.RU employee, who is directly involved in the development of the downloader, responded on an authoritative Internet portal to numerous claims and real facts based on the analysis of the code and behavior of this Downloader, which allow us to safely state: Downloader from Mail.ru is nothing more than a Trojan!
As known, Mail.RU in recent years, they have significantly lost their share in the Russian Internet market. They are probably saved only by Odnoklassniki. After all, few people now use their search (by the way, at the moment they do not have their own search engine, like Yandex, they use Google technologies), ICQ is also a thing of the past, their mail is mainly used for all kinds of subscriptions, spam and other garbage , "Dating" and "My World" were absorbed by more successful social networks, etc. And the company somehow needs to monetize its projects. So they decided to follow the path of "affiliate programs" - they offer various resources a way to earn money, through this very "loader".
A simple example: there is such a torrent tracker "free torrents" (I will not write the address in light of the adoption of the law on blocking sites according to Federal Law 187), and if anyone noticed, when downloading a torrent, they have such a "download quickly" feature. And, if you use this feature, then not a torrent file is downloaded, but a file with the extension .exe (moreover, the shortcut for the file is uTorrent, and this is at least the use of someone else's trademark, that is, it is illegal. , an inexperienced user, without a shadow of a doubt, will download this file, and this loader will be loaded on his computer, together with Guard (which will “protect” and prevent itself from being deleted) and “Internet Browser.” And the torrent tracker gets money for each such download. And there are many such partner sites that mislead people, and the antivirus will not swear at this file, because it is signed by a legitimate signature. Mail.RU.
Now imagine that on some site, through this downloader, you will not download “ internet browser“What about a real Trojan or rootkit signed with a legitimate digital signature? And imagine the scale of all this ... After all, not every "partner" Mail.RU honest and will not shove anything of its own into this bootloader. And I am more than sure that quite a few cyber fraudsters have already taken advantage of this.
These are the pies, friends. You can read about all this in more detail on various resources on the network, such as Habr. Well, and we, let's move on to practice, that is, protection from the Mailov poop.
But first, it is worth noting that such aggressive marketing was not really invented in Mail.RU (I think they would not be smart enough for this). Yandex, for example, also has its own "Defender", but in defense of Yandex I can say that they do not act so aggressively, and there has never been such a thing that unchecking the checkboxes installed their pribluda, unlike emails. Various services like AOL, Ask.com, ICQ, etc. also use the installation of their toolbars or software in third-party software, and they have been doing this for a long time. But what went for Mail.RU Openly deceiving users with false updates of third-party software is, of course, nonsense.
So let's fight this!
So we finally moved on to practice. Of course, most users who actively use the Internet, and even more so who have their own blogs, are well aware of what UAC (User Account Control) is, administrator rights, etc., and they also know and understand that when installing any software software, you cannot blindly press the button "next", but you need to carefully review everything, remove unnecessary ticks, etc. But we all have mothers, sisters, friends, clients, at last, who do not even know about such things.
So, in order to protect them from such misfortunes, we will use the following opportunities: Group Policy and AppLocker... I must say right away that this only works on Windows 7 Ultimate and Enterprise operating systems (at the end of the article I will write in more detail how to upgrade my version of windows). As for Windows 8 - I also have this configuration section on my laptop, so it should also work (below there will be screenshots from just 8). These policies are also present in Windows XP, however, as far as I know, there is no way to block software by digital signature.
First, we need an XML file and fill it with rules.
Now, we need to start the service " Application Identity", And set automatic start mode for it, otherwise the function AppLocker will not work. To start this service, open: Control Panel - Administrative Tools - Services.
Double-click on "Application Identity", the properties window for this service will start. Now we need to start this service, and enable automatic startup type for it:
Done, click on "OK". If your service is already running, be sure to enable automatic startup type for it, as shown in the figure above. By default, the startup type for this service is set to Manual.
That's it, we're done with the services. Now we need to import the previously created list (which we previously named blockmailru.xml) into AppLocker... To do this, open again:
Control Panel - Administrative Tools - Local Security Policy.
Looking for: Application Control Policies - AppLocker.
Right-click on AppLocker and choose “ Import policy ...". After that, in the window that opens, you need to point to the blockmailru.xml file we created and open it. The system will prompt you to change the policy and notify that all previous policy rules will be replaced. We agree. Everything. Most of the work has been done. In the "Executable rules" you will see the following picture:
The same picture will be in the item "Windows Installer Rules"
An important point! The screenshot does not show this rule, but there is an item in the rules: Allow - All - D: Portable Soft *. You won't have it initially. This rule states the following: allowed to run by any user and any program from the Portable Soft folder located at the root of the D drive... What is it for? As the name of the folder suggests, this rule is primarily necessary to run portable programs (i.e., which run without installation). Or, for example, to allow the installation of those programs, the installers of which you put in this folder (for example, I put all the games from the Alawar disk into this folder for my sister's son so that their installation is not blocked, and he could install them on his own, without enter the administrative password).
You also need to enable such a rule. This is done very simply. Create a folder where it is more convenient for you (at least on the desktop), name it something (like "Portable"), and put all portable programs and installers that you trust in it. Next, open again (if closed): Control Panel - Administrative Tools - Local Security Policy - Application Control Policies - AppLocker... Right-click on "Executable rules" and select "Create new rule ...". Everything is simple there: click "next", "next", then tick the "Path" box, "next" again and "Browse folders". A window will open in which you will need to specify the same folder and again “next”, “next”, and at the final stage “create”. The rule has been created. In fact, everything is as easy as shelling pears. In addition, when creating or editing such rules, you can specify exceptions, allow or block paths (folders), publishers, etc.
The same must be done for such programs that are not installed in Program Files, but for example, in C: UsersusernameAppDataLocalApps. In general, if after the settings you have made, some program does not start, add its location to the rules. Similar to how we added permissions for the "Portable" folder
Let's now finally understand what we have achieved with all these manipulations, and what we are now prohibited from, and what is allowed:
- blocking start and installation any programs from publishers such as: CNET, Yandex, AOL, SweetIM, Uniblue, ASK, Mail, Messenger Plus, Hamster, Mediaget, Reg Organaizer. All of these publishers have been found guilty of fraudulent activities (covert installation, etc.). The list can be independently supplemented and edited. I'll write about this in the next article, which will also explain how to add exceptions;
- allowed to run all programs that are located in Program Files, Windows and in the folder (directory) that we added ourselves;
- allowed to run any programs by the local administrator (i.e. by the administrator account)
- Allowed execution of digitally signed Windows Installer files (digitally signed .msi files).
- Allowed execution of digitally signed Windows Installer files (digitally signed .msi files) located in the Installer directory (in the Windows folder).
- Any Windows Installer files are allowed to run by the local administrator (i.e., the administrator account).
Thus, no Guard; s, Defenders, left browsers from Mail.RU, from Yandex, Satellites, Yandex-bars, and other unnecessary trash will no longer appear on your computer, or on the computer of your relatives and friends. All programs from the specified publishers will no longer penetrate the computer on which these rules apply; they will simply be blocked.
And finally I want to say - never get fooled by advertising gimmicks, do not download any assemblies of "Yandex Browser" or " Internet browser“, Because all this is the most ordinary Google Chrome (to be more precise, these are all Chromium-based browsers).
When installing any software, always follow the "check marks", look carefully so as not to install third-party software.
And one of the main rules - download the software ONLY from the official sites.
We upgrade the version of our Windows 7 to Ultimate.
If you do not find in the Control Panel - Administrative Tools section Local security policies, it means that your version of Windows does not match the corresponding one (only the ultimate and the corporate one are suitable, as already mentioned above). There is an easy way to upgrade from home basic, home premium to ultimate.
Here we just need to accept the agreement, after which you will see an update window, just click update and wait (10 to 20 minutes on average).
That's it, now we are waiting for a while, our computer will reboot and we can check the result:
That's it, now we are the owners of Windows 7 Ultimate and can use AppLocker.
Very often (this usually happens when installing illegal software) other advertising products in the form of unnecessary applications, toolbars, etc. penetrate our computers. In some cases, respectable developers warn us about this and give us the opportunity not to install them by unchecking the checkboxes, such as during installation.
(As you can see in the screenshot above, in addition to the main application, we are invited to install McAfee Internet Security and True Key by Intel Security)
But more often than not, unnecessary utilities appear on the disk secretly or through the user's inattention. One way or another, in order to prevent such "interference" in the future, today I will talk about how to prevent their subsequent penetration into the PC.
Unchecky - Program for removing unnecessary programs from your computer
If such utilities have already appeared, then there is only one way to get rid of them, namely, uninstall. This can be done both by internal Windows utilities and by third-party utilities - Ccleaner or Revo Uninstaller, etc. And one more recommendation for fixing, so to speak - at the end of the procedure, I strongly advise you to also “go through” ADWCleaner to find and clean up other / remaining unwanted software.
Well, now let's move on to the main question of our topic.
Perhaps that's all. In turn, I want to ask what methods do you use? I ask you to write your answers in the comments under the post. Thanks!
There are several ways to prevent the installation of programs on Windows 7, which will now be considered. Why is this necessary? For example, if you are not alone using a computer and strangers constantly install unnecessary software or games. Also, this ban will be able to protect Windows 7 from imposed software that you do not need. There are many other reasons as well.
Prevent installing apps using the Group Policy Editor
In order to prohibit the installation of applications, you need to open the group settings editor - gpedit.msc. You can do it like this: open the Start menu - click on the "execute ..." button - register gpedit.msc there. After that, the window we need will open, in this window you will need the "Administrative Templates" section.
Click on "Windows Components", then you need to scroll down and find the folder. " When it opens, under the line "State" there will be commands, we need "Disable Windows Installer". It is necessary to click on it 2 times, and when the window appears, then select the "Disable" function, which accordingly sets a ban on the installation of programs. The Enable function overrides this prohibition.
How to prevent a specific user from installing applications on Windows 7
Prohibiting the installation of software for a specific user on Windows 7 requires the creation of a corresponding snap-in. You need to enter the mmc console (start menu - "Run ..."), then in the console click on the "File" tab and click on "Add or remove snap-in ..."
The corresponding panel will open.
In this panel, select the "Group Policies" snap-in, and then click on the arrow. A window will appear, in it you need to click the "Browse" button, select the "Users" tab, then select the user you want to prohibit the installation of Windows 7 programs for. We confirm the transaction, and you're done.
Then you need to repeat all the steps that are described in the above (see "Prohibiting installation using the policy editor", but the prohibition to install software in Windows 7 will now only affect the specified selected user.
Prevent installation of programs using parental controls (Windows 7)
This method is much simpler, judging by the number of transactions, and it is applicable in cases where the person sitting at the PC installs too much garbage.
To prevent the installation of programs using parental controls, the following is required (works only on Windows 7):
Go to the Windows 7 Control Panel through the Start menu, and click on the "User Records Management" tab
Click on the "Parental Control" button
We select the user to whom we want to prohibit the installation of programs.
We need "Restrictions on"
Just click on the tab, after which the console opens in front of us, where we put a checkmark:
Windows 7 automatically detects programs that can be blocked. If the required application is not found (ie it will not be in the list), then you can find them yourself through the "Browse" button and block.
Prevent installation of programs using the registry (Windows 7)
Here we need to click on the "Run ..." tab through the Start menu and enter the following command - regedit.exe. A window will open in front of us, in which it will be necessary to precisely follow this path in order to get to the goal:
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ Current Version \ Policies \ Explorer \ DisallowRun
Then, in the "DisallowRun" item, create a text parameter called 1 and add the name of the application executable file with the extension.exe to it.
For example, if you need to block msiexec, then you just need to create a text parameter 1 and initialize it with the string "msiexec.exe" and then give them the names of the EXE files of the applications and you're done.
After that, you only need to restart your computer.
If a stationary computer or laptop out of necessity is used by not one, but several users, it is quite natural that each of them can install the programs that he needs for daily work or entertainment into the system. This can lead to unpredictable consequences that relate to a possible violation of the functionality of the operating system.
It is quite simple to prohibit the installation of programs in Windows XP and on systems with a rank higher than one or several users at the general level. However, the most logical solution, consisting in excluding users from the administrator group or increasing the level of UAC control, has no effect in the seventh version of Windows and later modifications of the system, since in them you can still use the start of the installer just on behalf of the administrator. Despite this, several options for setting the ban can still be applied.
Does it need a software installation ban?
To begin with, let's briefly dwell on why and for what it is necessary to introduce such prohibitions from the side of the administrator.
The problem here is not even that the user can install completely unnecessary software, but rather that during the installation of some applications, a huge amount of so-called partner software can often be installed (which is often ignored by many users due to their inattention). In addition, some viruses (for example, of an advertising nature) are very successfully disguised as such applets.
And in general, the installation of unnecessary software products leads to cluttering up the hard disk and slowing down the computer's performance in the case when the installed programs write their own settings in the system startup and in the system registry. And without special knowledge and skills, it can be extremely difficult to remove installed applications as completely as possible, and it is best not to rely on Windows tools.
How to prevent the installation of programs on Windows 7 in the Group Policy settings?
Since we will focus on the seventh modification of the system below, we will start from its basic settings and parameters. But the solutions given can be similarly applied in later versions of the OS. So, how to prevent the installation of programs on Windows 7 for all users at a general level, including possible installation initiated by the applications themselves, for example, during an update? This can be done through group policies. Access to the editor is carried out by the gpedit.msc command, which is registered in the "Run" menu (you must check the box at the task launching point with administrator rights).
In the editor, use the sections of the administrative templates and Windows components, and then select the item to deny the installer from the list. After that, through a double click, you should enter the editing of this parameter, set it to the on state and apply the changes.
Snap action
In Windows 7, access to setting bans on any actions performed by a potential user of the system can also be obtained through the so-called snap-in management console (mmc).
Here, first, through the file menu, you need to select the addition of a new snap-in, then select group policies from the list of available tools and add it to the list of the window on the right with the Add button. In a new window that opens, using the browse button, you should call another window, go to the "Users" tab and mark the user for which the ban should be in effect.
When the snap-in will be added through the "File" menu, it must be saved using the standard methodology with the assignment of the registered administrator's name as the name. After that, you need to repeat the above steps in, but in this case, the installation of programs in Windows 7 will be prohibited only for the selected user.
Note: if necessary, you can create several snap-ins or set bans for all registered users.
How to prevent a user from installing Windows 7 programs using parental control options?
To set bans, you can use another method, which, according to most experts, is the simplest and does not require special knowledge of system tools. How to prevent the installation of programs on Windows 7 and above systems using this tool? To do this, in the "Control Panel" you need to use the Account Management section with the selection of the parental control setting item.
Further, the user for whom the ban will be set is simply marked, and the corresponding parameter for restricting the launch of programs is activated. The system will automatically create a list of applications that can be blocked, but if the program is not found, you can specify the path to it yourself through the browse button.
But, judging by the advice of experts, you need to clearly understand that the disadvantage of this technique is that you can only restrict the start of installed applications, and not those that the user is going to install, although if you wish, you can add Windows installers to the list.
Setting a ban in the registry
Speaking about how to prohibit the installation of programs on Windows 7 with regard to restricting the launch of the applications themselves or the system installer, you can use an equally effective method, which consists in changing the key specially responsible for this in the registry (regedit).
The section is called DisallowRun and is located along the path shown in the image above. To set a ban, you just need to create a new parameter and specify the path to the executable EXE file, and then restart the computer device.
Note: for each application, the parameter is created separately, if necessary, you can set additional key values (2, 3, 4), but the prohibition itself will affect all users who do not have administrator privileges in the system.
Brief summary
To summarize all of the above, most likely, many have already realized that setting restrictions on the launch of installed applications is the simplest, but far from the best solution. If, for any reason, you need to prohibit the installation of programs, it is best to use Group Policy or the snap-in management console, which is confirmed by most computer security experts.
But actions with these editors in any case should be performed exclusively when logging into an administrator account or using the proper rights to change the system configuration. As a third-party tool, you can use the App Locker utility, but the actions with it are almost exactly the same as managing policies and snap-ins (only the settings are imported, not set manually), so it was not considered.
There are several ways to prevent the installation of programs on windows 7, which will now be considered. Why is this necessary? For example, if you are not alone using a computer and strangers constantly install unnecessary software or games. Also, this prohibition will be able to protect windows 7 from imposed software that you do not need. There are many other reasons as well.
Prevent installing apps using the Group Policy Editor
In order to prohibit the installation of applications, you need to open the group settings editor - gpedit.msc. You can do it like this: open the Start menu - click on the "execute ..." button - register gpedit.msc there. After that, the window we need will open, in this window you will need the "Administrative Templates" section.
Click on "Windows Components", then you need to scroll down and find the "Windows Installer" folder. When it opens, under the line "State" there will be commands, we need "Disable windows installer". It is necessary to click on it 2 times, and when the window appears, then select the "Disable" function, which accordingly sets a ban on the installation of programs. The Enable function overrides this prohibition.
How to prevent a specific user from installing applications on windows 7
Prohibiting the installation of software for a specific user on windows 7 requires the creation of a corresponding snap-in. You need to enter the mmc console (start menu - "Run ..."), then in the console click on the "File" tab and click on "Add or remove snap-in ..."
The corresponding panel will open.
In this panel, select the "Group Policies" snap-in, and then click on the arrow. A window will appear, in it you need to click the "Browse" button, select the "Users" tab, then select the user you want to prohibit the installation of windows 7 programs. We confirm the transaction, and you're done.
Then you need to repeat all the steps that are described in the above (see "Prohibiting installation using the policy editor", but the prohibition to install software in windows 7 will now only affect the specified selected user.
Prevent installation of programs using parental controls (windows 7)
This method is much simpler, judging by the number of transactions, and it is applicable in cases where the person sitting at the PC installs too much garbage.
To prevent the installation of programs using parental control, the following is required (works only on windows 7):
Go to the windows 7 control panel through the Start menu, and click on the "User Records Management" tab
Click on the "Parental Control" button
We select the user to whom we want to prohibit the installation of programs.
We need "Restrictions on running programs"
Just click on the tab, after which the console opens in front of us, where we put a checkmark:
windows 7 automatically finds programs that can be disabled. If the required application is not found (ie it will not be in the list), then you can find them yourself through the "Browse" button and block.
Prevent installation of programs using the registry (windows 7)
Here we need to click on the "Run ..." tab through the Start menu and enter the following command - regedit.exe. A window will open in front of us, in which it will be necessary to precisely follow this path in order to get to the goal:
HKEY_CURRENT_USER \ Software \ Microsoft \ windows \ Current Version \ Policies \ Explorer \ DisallowRun
Then, in the "DisallowRun" item, create a text parameter called 1 and add the name of the application executable file with the extension.exe to it.
For example, if you need to block msiexec, then you just need to create a text parameter 1 and initialize it with the string "msiexec.exe" and then give them the names of the EXE files of the applications and you're done.
After that, you only need to restart your computer.
It is worth mentioning that depending on the version of windows: "maximum", "basic", "professional", as well as on its assembly, some of the names of the names can be changed, and consistently slightly different - but not radically. But all commands will function on any version, as well as the work done.
windowsTune.ru
How to prevent the user from installing windows 7 programs
Many system administrators, laboratory assistants and people responsible for the health of computers in computer clubs, classrooms and even at home are faced with the need to prohibit the installation of applications on windows 7. This can be done using third-party applications, for example, WinGuard Pro 2016, but we will try to implement the ban to install programs by means of "seven".
Blocking the installer
In order to prohibit the installation of programs for any user, you need to block the windows installer using the group policy editor.
- We enter "gredit.msc" in the search bar or the "Run" window (called by "Win + R").
- Follow the path: "Local Computer" → "Computer Configuration" and double-click on "Administrative Templates".
- In the directory we find "Windows Installer", and in the "Status" frame we look for "Disable windows installer".
- Double click on the parameter and move the trigger to the "Disable" position.
Allow only allowed applications to run
Knowing that blocking the installation of the installers of all programs in this way will not work, due to the use of alternative installers, we will use one trick: we will allow the launch of only a limited range of applications from the specified directories.
- We execute the command "secpol.msc" through the command interpreter or search line.
- We perform the action shown in the screenshot to block the launch of programs.
Now let's make some settings.
- We call the "Properties" item "Application" in the active section and set the following rules.
This activates the scan of all programs and gives the user less opportunity to run executable files. If the administrator account is password-protected and does not need to block software installation for him, select the "For all users except the administrator" option in the second option.
- Click "OK" and open "Assigned file types" to allow the launch of applications through shortcuts in windows.
- Select the "lnk" extension and click "Delete".
See also: How to remove password from windows 7 computers
- Go to "Security Levels" and set "By default" for the "Forbidden" parameter.
- In additional rules, we create a path rule if it is necessary to remove the prohibition on launching applications from directories other than windows and Program Files.
- In the "Path" line, set the directory (for example, the location of the folder with portable software or games), which will be an exception to the rules for any computer user, except for the administrator, if the corresponding parameter is specified in paragraph 3.
To test, you can try running the installation or even launching the application from any directory that is not included in the list of excluded ones.
Restricting the installation of applications for a specific user
If it is necessary to prohibit the installation of third-party programs for a specific user, then we will use one more secret of windows 7.
- We execute the command "mmc".
- Create a new snap-in via the "File" menu item.
- Stop at the Local Policies snap-in and click the arrow to add it.
- Click on "Browse", and on the "Users" tab, select the user for which we want to prohibit the installation of applications in the windows 7 environment.
- Click "OK" to confirm the transaction.
- Go to "File" - "Save As ..." and enter a free name for the new snap-in.
After restarting the PC, the changes will take effect.
Parental Control Features
The simplest method used on home PCs to restrict the installation of third-party applications, for example, for children, who often install a lot of garbage, is a control panel applet called Parental Controls.
- We go to this item and select the user who needs to cut privileges.
- We activate the function of restricting the launch of programs.
- Check the boxes of the applications that are allowed to run.
If there is no product available, use the Browse button.
After the next user login to the system, the ban will take effect.
(Visited 14,592 times, 2 visits today)
windowsprofi.ru
How to prevent the installation of any programs on windows 7 by different methods?
Good day.
Quite often there are situations when several users work at one computer at once. And it often happens that some of them constantly install a variety of software on the device, not only "opening doors" for viruses, but also simply clogging up the hard drive. In the seventh version of the operating system from Microsoft, several tools are provided at once to limit the above-described capabilities. In this article I will tell you how to prevent other users from installing programs on windows 7. Believe me, such a move will significantly improve security.
Group Policy Editor (back to contents)
One of the easiest ways to restrict the movement of other users is by using Group Policy. To achieve the desired effect, we perform several actions:
This will completely prohibit the installation of any software on the unit. To return everything to its place, you need to toggle the checkbox back. Another effective way is to reinstall the operating system with the preliminary formatting of the main disk.
Banning a specific account (back to content)
Windows x64 also provides the ability to impose a ban on a specific user. To do this, you need to take several steps:
Parental control (back to content)
This method is considered to be as simple and convenient as possible for implementation. It allows you to restrict traffic if the user installs a lot of unnecessary software from the Internet. You need to perform a number of actions:
As you can see, this makes it possible to quickly and easily restrict the installation possibilities for an ordinary user.
Registry editor (back to table of contents)
An equally effective way is to use the "Registry Editor". Where is this tool located and how do I use it? It's simple:
Press "Win + R". This will launch the Run menu.
We indicate in the line "regedit.exe".
A window will appear, on the left side of which we go to the "HKEY_CURRENT_USER" directory, and then to "Software".
After we are interested in "Microsoft" and "windows".
As a result, we need the "DisallowRun" directory.
On the right side of the window, right-click and create a text parameter. We give it the name "1", and inside we add the name of the application that needs to be prohibited. In this case, it must match the executable file with the * .exe extension.
If you need to prohibit more than one program, we accordingly create additional parameters, which we call numbers in order, and inside we indicate the applications.
We reboot.
After that, none of the software downloaded automatically for free from the Internet will not be able to be installed.
It is worth noting that this tool allows you to block the installation of any applications without a password.
It is important to keep in mind that depending on the assembly, some points may differ slightly. For example, the version "Maximum" and "Home Basic" differ. Despite this, users will accurately understand the sequence of actions.
Due to the fact that the operating system itself provides a lot of tools, although additional software on this topic was developed, it still did not receive mass approval, and therefore it is simply not popular. At the same time, we did not consider shutdown using the program.
If suddenly after reading the article you still have some questions, you can watch a video on this topic.
Hope you achieve your desired goals. Subscribe and tell others.
windwix.ru
We prohibit the installation of programs on windows 7
Computer security has always been the most important issue for the user. As you know, viruses that get inside a gadget can bring a lot of discomfort to its owner. There are no ways to 100% protect your desktop from malware penetration, but there are ways to maximize resistance to them.
The most accessible is to prohibit the installation of programs in windows 7. This can be achieved absolutely free of charge, and a program that will help with this is already available on most versions of windows. The principle of operation is outrageously simple: no programs can be downloaded without the user's permission. And then you will not face such a problem as the appearance of a banner windows blocked, as well as other problems that viruses bring. How to do it? Let's figure it out.
How to set a limit
First, you need to open the "Local Security Policy" window. To do this, go to "Start" - "Control Panel" - "System and Security". Then go to "Administration", and there you will see "Local Security Policy" - "Software Restriction Policy". On this line, right-click and create a new software restriction policy.
Now you need to configure some settings for the new policy. To do this, click on the "Application" line and check the box in the same places as in the picture below.
After that, go to the item "Assigned file types" and feel free to remove the LNK extension. Then we go to the additional folder "Security levels", we see the sub-item "Forbidden" in the right part of the window and set it by default (with the right mouse button).
That's all, now all users from your computer will be able to run only those programs that you install, or the system will do it for you. They are usually found in the Program Files and SystemRoot folders, but they can be scattered around other folders as well. If this is your case, then I advise you to add these programs to the list of allowed. To do this, in turn, go to "Additional rules" - "Name", right-click on an empty field. Among the rest of the commands, select "Create a rule for the path", and set the path to the folder where the required program is located.
As you can see, there is absolutely nothing complicated in these actions. These rules will take a few minutes to complete, but think about how you can improve the security of your computer. It's not a pity to set aside a couple of minutes of your precious time for this, do you agree?
You can increase the security of your computer if you install anti-virus programs. This will be a nice addition to the above steps!
Video to help
userologia.ru
How to prevent unwanted programs from being installed on windows
For most users, a variety of additional messengers, toolbars, application managers from Mail.ru, Yandex, Amigo are useless and even unwanted software. Who cares when a Google search is suddenly replaced with a different ad-laden URL? Unfortunately, the installation of such creations is not always traceable. But it can be prevented. Let's consider the main methods.
Prohibiting hidden installation of programs
Unchecky
One of the methods of dealing with hidden installation of programs (for example, when a browser is installed along with the game) is Unchecky. This program removes all additional, often invisible to the user, checkboxes with unwanted suggestions during the installation of a program. The utility is also capable of finding third-party hidden programs in the running file and notifying the user about it.
Unchecky does not require any specific knowledge to use and configure. The user can only configure the program icon in the tray. Almost perfect, but sometimes Unchecky will still let fresh nasty things go to the hard drive.
AppLocker
You can not install anything superfluous and get by with the tools built into the operating system. So, in windows 7 Ultimate and Professional and windows 8 and 8.1 there is the AppLocker utility. It allows you to compile a list of applications prohibited for installation.
oszone.net Instead of long manipulations of compiling your own list, you can also download a ready-made Locker settings file and install, for which you will need to do the following:
- go to the menu "Control Panel" → "Administrative Tools" → "Services";
- put the "Application Identity" service into autorun mode and click "Run";
- go to the menu "Control Panel" → "Administrative Tools" → "Local Security Policy" → "Application Control Policies";
- select the AppLocker option, right-click the menu, select Import Policy, open the Locker.xml file from the archive.
