How to limit who can install software on your computer
The surest way to stop other people from installing software is to use a standard account for everyday work and keep admin rights with one trusted person. On a family laptop or shared office PC, that usually means only one account can approve installs, while everyone else logs in with limited access. If you need tighter control, you can also block installs from the Microsoft Store, App Store, or browser downloads so an app needs permission before it lands on the device.
Prerequisites
- A Windows or macOS account with admin access for the person making the change.
- The password for the admin account, if the device already has one.
- Access to any shared-device or family-control settings you plan to use.
- A second, non-admin account to test with, or a way to sign in as a standard user.
Steps to limit who can install software
- Decide which account should keep admin access.
Pick one trusted person to hold the admin account. Everyone else should use standard accounts for daily use.
- Change the daily account to a standard user on Windows or macOS.
On Windows, open the account settings and change the other person’s account type from administrator to standard user. On macOS, open Users & Groups in System Settings and make sure only the trusted account is allowed to manage the Mac. On a shared device, use the built-in user controls or family settings to give the regular user limited access.
- Remove extra admin access if someone already has it.
If another person can already install software, change that account back to standard and update any shared passwords that would let them sign in as an admin. If you do not know which account has admin rights, check the user list before you make changes so you do not remove your own access by mistake.
- Block the easy install paths from stores and browsers.
On Windows, use the device’s Microsoft Store controls or family settings to prevent installs if you want stronger limits than account type alone. On macOS, use Screen Time or Content & Privacy Restrictions to limit App Store installs and changes to app settings. For browser downloads, use standard accounts and any available browser or family controls to stop people from installing software after they download it. If the device does not offer a specific block, the standard-account limit still stops most system-wide installs.
- Keep one private admin account for updates and repairs.
Use that account only when you need to install trusted software, update drivers, or fix the device. Do not share the password with everyone who uses the computer.
- Test the setup from a standard account.
Sign out of the admin account and sign in as a standard user. Try to install a small app from the Microsoft Store, App Store, or a downloaded installer. The system should ask for an admin password or deny the change before it completes.
When you should not lock this down completely
Do not make the device so locked down that you cannot maintain it. Some software needs admin approval for updates, printer drivers, security tools, and backup software. If no one can approve those changes, the machine will get stuck.
That tradeoff matters most on work machines and shared household computers. For a small office PC, one trusted person should still be able to install accounting software, browser updates, or remote-support tools when needed. For a family computer, one adult admin is usually enough, with everyone else on standard accounts.
If you expect to install software often, keep a separate admin account just for maintenance and use a standard account for daily work. That gives you the safety of limited access without making normal upkeep a headache.
The goal is control, not frustration. Keep one trusted path for updates and repairs, and make sure everyone else uses the limited account by default.
How to confirm the restriction is working
- A standard user cannot install software without an admin prompt.
- The Microsoft Store or App Store asks for approval before a new app can be added, if you turned on those restrictions.
- A downloaded installer does not finish without admin approval.
- You can still sign in to the admin account and make updates when needed.
If a test install still goes through, check whether the test account is actually a standard user, whether another admin account is still active, and whether store or browser restrictions were turned on in the right place.
Conclusion
If you want the short version: make everyday users standard accounts, keep one private admin account for trusted installs, and close the obvious bypasses in app stores and browser downloads. Then test from a non-admin account so you know the prompt appears before you hand the device back. If something still installs without asking, check for leftover admin accounts or family controls that need another pass.
Frequently Asked Questions
Can a standard user still install anything at all?
Usually yes, but only if the installer does not need system-wide changes or if an admin approves it. Some portable apps may run without a full install, which is why browser and download controls can matter too.
Will this stop app updates too?
Not always. Some apps update within the user account, while others need admin permission. If updates matter, test the specific apps you use so you know which ones will prompt.
What is the quickest fix if I only want to stop casual installs on one family PC?
Change the daily account to standard user and keep one admin account private. That alone stops most unapproved installs.