Block installations without notifications.

I have a multi user computer. What I want to do is block anyone from installing any programmes. I know that I can set the user accounts to limited in XP home but I need the other accounts to have administrator rights for other reasons. I did have Comodo Firewall set up to stop any unknown applications & exe files from being run and I also suppressed the alerts and added a password in parental controls. The reason I done this was because the other users were allowing any alerts that came on screen from Comodo Firewall and were allowing things to run. I have tried to explain to them not to do this but they do it anyway. With the settings I had anyone who tried to download and run any files by double clicking them a windows display box would appear with an error, usually saying something could not be accessed or you do not have permission. That way no alerts would ask them what to do.
I have been playing with settings and now for some reason this no longer happens anymore. It seems that any file is allowed to run, and with installations the usual “run” option box now appears. What I would like to do is stop this from ever happening, I want to restrict things so that any exe file that is double clicked gets an instant error message. However I cannot remember how I got it set to that to begin with.

Does this make sense and can anyone help please?


I guess you need to check exploere.exe policy\Run an executable policy.

Please check if your Defense+ mode is set to Disaled or Training.

Defense + is set to clean pc mode.

How do I check the explorer.exe policy or modify it?

Defence+/Advanced/Computer Security Policy

Its set as installer or updater, do i need to change this?

Yep. Change it to “Use custom policy”

CleanPC mode will learn all application currently installed if they are not added to Pending list.

So basically this means that you need to check explorer “Run an executable” allowed list and remove all executables you wan to disable when CFP parental control is activated.
If you enable the option to suppress alert when the password is active then no one should be able to run unknown programs.

But if you enable regedit or cmd.exe it could be possible to disable these protections.