How to prevent ordinary users from installing software on windows server 2016?

Question

Windows Server

By default, vatsaps, telegrams, chromes (into the user environment) are installed without question. But they can also install malware with them.
How can I disable any settings at all?
Isn't there an easy one-click way instead of dancing with AppLocker?

Answer 1

Through the "Software Restriction Policies" you can set up a white list of directories from which applications are allowed to run. But I'm not sure how various updaters that like to unpack themselves into a temporary folder behave in this case. Can be configured to not apply to administrators.

Answer 2

If we are talking about a terminal server, then there it is limited to local and / or group policies, including Software Restrictions Policy and AppLocker
And do not give administrative rights to everyone in a row ...