How to prevent guest account from installing software

Question

A "guest" was able to install Google Chrome on the guest account in Windows XP.

How can I prohibit installation of any software in Windows XP and Windows 7?

Solution

A guest does not have rights to install system-wide software, but he can write to his or her profile.

Combine that with programs which can run from a single binary or which are specifically designed as 'portable' applications with no need to access the registry or anything else outside their start directory and a guest can run each such program as desired.

The only way to stop that is to blacklist all programs except those on a whitelist. Windows has policies for that. To enable those use gpedit.msc and add new software restriction policies.

Comments

[codesparkle]

Long live chrome! You should probably let them use it, as it's likely to be a lot safer than whatever browser you are currently letting them use.

[Karan]

Chrome does this deliberately (see Why does Chrome install itself under user directory instead of Program files?)

[Moab]

gpedit is only on Pro or higher versions of windows.

[Ramhound]

@Moab - The author gave no indication this would be a problem.

[Moab]

They gave no indication either way.

[ganesh]

If they can not find it the OP can always adjust the OP. For what it is worth it, if I had realised it needed the pro version at posting time I would have added it at that time.