Blocks WPS office in domain.

To prevent users from installing apps like WPS Office without admin approval, use a combination of app installation and application control policies. The context provides two main levers: blocking non-admin app installs and controlling packaged app behavior.

1. Block non-admin installation of packaged apps (GPO/MDM)

Use the BlockNonAdminUserInstall policy to stop non-admin users from initiating Windows app package installations:

• Policy path (MDM / Intune custom OMA-URI):
  • ./Device/Vendor/MSFT/Policy/Config/ApplicationManagement/BlockNonAdminUserInstall
• Allowed values:
  • 0 (default): Disabled – all users can initiate installation of Windows app packages.
  • 1: Enabled – non-admin users cannot initiate installation of Windows app packages.

When enabled:

• Non-admin users are blocked from initiating installation of Windows app packages (MSIX/APPX) outside the Store.
• Admins must install apps from an elevated/admin context.
• Store installs remain governed by other policies.

Group Policy mapping (for domain-joined devices):

• GPO name: BlockNonAdminUserInstall
• Friendly name: Prevent non-admin users from installing packaged Windows apps
• Path: Computer Configuration > Windows Components > App Package Deployment
• Registry key: Software\Policies\Microsoft\Windows\Appx
• Registry value: BlockNonAdminUserInstall

Deploy via:

• Intune: Device configuration profile using a custom OMA-URI or Settings Catalog (ApplicationManagement CSP) targeting devices.
• Group Policy: Configure the above GPO on the OU containing user devices.

2. Combine with Store/MSIX blocking policies

For broader control of packaged apps (including non-Store MSIX/APPX), use the MSIX / Store blocking policies described in the Group Policy and packaged apps guidance. For example, when:

• BlockNonAdminUserInstall = Disabled
• AllowAllTrustedApps = Disabled
• AllowDevelopmentWithoutDevLicense = Disabled

Then:

• Store-signed packages (double-click or PowerShell) install.
• Trusted non-Store packages are blocked (double-click or PowerShell, even elevated).

This pattern can be used to:

• Allow only Store-signed apps.
• Block sideloaded or non-Store packaged apps that users might download and run.

3. Use application control/AppLocker/App Control for Business (where applicable)

For stricter environments, combine the above with application control:

• Use AppLocker or App Control for Business to define allowlists and blocklists.
• Explicitly block known unwanted apps or their installers.
• Use recommended blocklists where applicable to prevent bypass tools and ensure users cannot run arbitrary installers.

4. Avoid policy conflicts

If both Intune (MDM) and Group Policy are used:

• Avoid dual configuration of overlapping policies (for example, app removal or app control policies) to prevent conflicts.
• Choose a single management channel per policy area where possible.

5. Operational guidance

• Target policies at devices, not users, for consistent enforcement.
• Test policies on a pilot group before broad rollout.
• Educate users that certain apps are intentionally blocked and that installation requires IT involvement.

This combination (BlockNonAdminUserInstall + Store/MSIX blocking + application control) provides an effective way to stop users with standard rights from installing or associating apps like WPS Office without admin approval.

References:

• Policy CSP - ApplicationManagement
• Group Policy and packaged apps
• Policy-based in-box app removal
• AppLocker CSP
• Applications that can bypass App Control and how to block them