Windows server machines can define a "Disable Windows Installer" policy.
This policy disables or restricts the use of Windows Installer. This policy can prevent users from installing software on their systems, or permit users to install only those programs offered by a system administrator. If you enable this policy, you can use the options in the Disable Windows Installer box to establish an installation policy.
- "Never" indicates that Windows Installer is fully enabled. Users can install and upgrade software. Windows Installer is enabled by default on Windows 2000.
- "For non-managed apps only" permits users to install only those programs that a system administrator assigns (offers on the desktop), or publishes (adds them to Add/Remove Programs).
- "Always" indicates that Windows Installer is disabled.
By default, on Windows server machines the policy is treated as "1", when not present. (On client SKUs, it is treated as default = "0"). This means that only managed installs (per-machine or per-user managed) are allowed. Per-user managed is the "dance" done by Group Policy for user assignment and publishing.