How to Completely Disable ‘Windows Installer’ (msiexec.exe) via Group Policy in Windows 11

Windows 11 relies on the “Windows Installer” service (executable msiexec.exe) as the core engine for installing, modifying, and removing software packages formatted as MSI (Microsoft Installer) or MSP (Patch) files. While foundational for software deployment, leaving msiexec.exe enabled and accessible to standard users represents a critical security vulnerability in strict enterprise, military, or zero-trust kiosk environments. If malicious actors or unauthorized users can execute MSI packages, they can potentially bypass AppLocker rules, exploit local privilege escalation (LPE) vulnerabilities within the installer service, or silently deploy unsanctioned “shadow IT” applications onto a secured workstation.

This guide explains how to completely disable ‘Windows Installer’ (msiexec.exe) via Group Policy in Windows 11, enforcing a strict zero-trust model where all MSI-based software installation is cryptographically blocked system-wide.

Disable Windows Installer via Group Policy

To enforce a strict block that disables the MSI execution engine globally across the OS, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > Windows Installer

5. In the right-hand pane, locate the policy named Turn off Windows Installer (or Disable Windows Installer).
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled.
8. In the Options pane below, open the “Disable Windows Installer” drop-down menu and select Always. (By explicitly setting this to ‘Always’, we instruct the Windows kernel to permanently sever the COM interfaces that allow msiexec.exe to initialize, universally blocking all MSI installations, regardless of whether they are unmanaged or managed by an administrator).
9. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes affecting core deployment services require the system to refresh its configuration.

To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, attempt to execute any standard .msi installer file (such as the installer for 7-Zip or VLC). The Windows Installer engine will immediately throw a fatal error dialog box stating, “The system administrator has set policies to prevent this installation,” and the installation will immediately abort. The Windows 11 workstation is now cryptographically bound to a strict, immutable software state, completely mitigating the risk of unauthorized MSI package execution.