How to Completely Disable ‘App Installer’ (MSIX) via Group Policy in Windows 11

The App Installer (handling .appinstaller and .msix files) is a modern Windows 11 feature designed to simplify the sideloading and deployment of Universal Windows Platform (UWP) apps outside of the Microsoft Store. While it provides a streamlined, one-click installation experience for users, it has recently become a massive vector for malware distribution. Threat actors frequently exploit the App Installer framework to bypass traditional security warnings, tricking users into deploying malicious payloads disguised as legitimate software updates. In a secure enterprise environment, all software deployment should be handled via endpoint management (like Microsoft Intune) or strictly through the curated Microsoft Store.

This guide explains how to completely disable the App Installer feature system-wide using the Group Policy Editor in Windows 11, preventing the execution of MSIX packages.

Disable App Installer via Group Policy

To enforce a strict block that prevents the OS from parsing and executing modern app packages from local storage or the web, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > Desktop App Installer

5. In the right-hand pane, locate the policy named Enable App Installer.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Disabled.
8. (Optional but recommended) In the same pane, also disable Enable App Installer ms-appinstaller protocol to block web-based execution triggers.
9. Click Apply, then click OK.

Verify the Security Lockdown

To enforce the change immediately across the system, open an elevated Command Prompt and execute gpupdate /force.

To verify the restriction is active, attempt to download and execute any .appinstaller or .msixbundle file from the internet (even a legitimate one). Instead of launching the modern, streamlined installation wizard, Windows 11 will actively block the execution. A system prompt will appear informing the user that the installation of this application is blocked by Group Policy. The endpoint is now successfully secured against this modern, highly exploited malware distribution vector.