You use Active Directory and GPOs to install applications but company policy forbids users from installing or removing applications. How do you enforce the policy? MSI installations require msiexec.exe and appwiz.cpl access. Change the permissions for these two files to Readonly for Authenticated Users and Everyone. Use RunAs to execute appwiz.cpl.