有用科技小编2026/10/27
浏览9772
阅读15分钟拦截捆绑安装要两头一起管：一头把系统侧的安装来源和静默安装权限收紧，一头在安装包运行时盯住它偷偷放出来的程序。只改其中一处，往往还是会漏进来。想真的拦住它，收紧账户权限、禁掉静默安装、打开系统自带拦截、盯住运行时动作、事后复测并清理漏网，这五处缺一处都容易漏。
多数是权限太松、策略被别的软件改回默认、或者旧安装残留没清干净造成的，系统和硬件本身大多没事，不用急着重装。以下方法在 Windows 10/11 实测可用。
适用系统：Windows 10/11；最后更新：2026-10-27。
为什么装了拦截，捆绑软件还是照样进来
不少人开了安全软件、安装时也点了「自定义安装」，装完桌面还是多出两个图标，任务管理器里冒出没见过的进程，到设置里一查，安装日期就是刚刚。也有人在装东西时看到「此程序被组策略阻止」并带错误码 0x800704EC，那是策略确实生效了，只是没堵在真正的入口上。
'/%3E%3Crect%20x='28'%20y='64'%20width='264'%20height='96'%20rx='12'%20fill='%23ffffff'%20stroke='%23dbe3ec'%20stroke-width='1.5'/%3E%3Crect%20x='28'%20y='64'%20width='264'%20height='6'%20rx='3'%20fill='%2315b88a'/%3E%3Ccircle%20cx='58'%20cy='106'%20r='17'%20fill='%23def5ef'/%3E%3Cg%20transform='translate(58,106)'%3E%3Cpath%20d='M0%20-9%20L9%208%20L-9%208%20Z'%20fill='none'%20stroke='%2315b88a'%20stroke-width='2.4'%20stroke-linejoin='round'/%3E%3Cline%20x1='0'%20y1='-2'%20x2='0'%20y2='3'%20stroke='%2315b88a'%20stroke-width='2.4'%20stroke-linecap='round'/%3E%3Ccircle%20cx='0'%20cy='6'%20r='1.4'%20fill='%2315b88a'/%3E%3C/g%3E%3Ctext%20x='82.0'%20y='102'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='15'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='700'%3E预勾选项%3C/text%3E%3Ctext%20x='82.0'%20y='124'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='12.5'%20fill='%235b6b7b'%20text-anchor='start'%20font-weight='400'%3E安装界面默认打钩%3C/text%3E%3Crect%20x='308'%20y='64'%20width='264'%20height='96'%20rx='12'%20fill='%23ffffff'%20stroke='%23dbe3ec'%20stroke-width='1.5'/%3E%3Crect%20x='308'%20y='64'%20width='264'%20height='6'%20rx='3'%20fill='%230a9472'/%3E%3Ccircle%20cx='338'%20cy='106'%20r='17'%20fill='%23def5ef'/%3E%3Cg%20transform='translate(338,106)'%3E%3Cline%20x1='-7'%20y1='-7'%20x2='7'%20y2='7'%20stroke='%2315b88a'%20stroke-width='2.6'%20stroke-linecap='round'/%3E%3Cline%20x1='7'%20y1='-7'%20x2='-7'%20y2='7'%20stroke='%2315b88a'%20stroke-width='2.6'%20stroke-linecap='round'/%3E%3C/g%3E%3Ctext%20x='362.0'%20y='102'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='15'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='700'%3E静默下载%3C/text%3E%3Ctext%20x='362.0'%20y='124'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='12.5'%20fill='%235b6b7b'%20text-anchor='start'%20font-weight='400'%3E装完才跟着冒出来%3C/text%3E%3Crect%20x='28'%20y='176'%20width='264'%20height='96'%20rx='12'%20fill='%23ffffff'%20stroke='%23dbe3ec'%20stroke-width='1.5'/%3E%3Crect%20x='28'%20y='176'%20width='264'%20height='6'%20rx='3'%20fill='%2315b88a'/%3E%3Ccircle%20cx='58'%20cy='218'%20r='17'%20fill='%23def5ef'/%3E%3Cg%20transform='translate(58,218)'%3E%3Cpath%20d='M8%20-2%20A9%209%200%201%200%206%207'%20fill='none'%20stroke='%2315b88a'%20stroke-width='2.4'%20stroke-linecap='round'/%3E%3Cpath%20d='M8%20-8%20L8%20-2%20L2%20-2'%20fill='none'%20stroke='%2315b88a'%20stroke-width='2.4'%20stroke-linecap='round'%20stroke-linejoin='round'/%3E%3C/g%3E%3Ctext%20x='82.0'%20y='214'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='15'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='700'%3E权限过大%3C/text%3E%3Ctext%20x='82.0'%20y='236'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='12.5'%20fill='%235b6b7b'%20text-anchor='start'%20font-weight='400'%3E一路允许没拦住%3C/text%3E%3Crect%20x='308'%20y='176'%20width='264'%20height='96'%20rx='12'%20fill='%23ffffff'%20stroke='%23dbe3ec'%20stroke-width='1.5'/%3E%3Crect%20x='308'%20y='176'%20width='264'%20height='6'%20rx='3'%20fill='%230a9472'/%3E%3Ccircle%20cx='338'%20cy='218'%20r='17'%20fill='%23def5ef'/%3E%3Cg%20transform='translate(338,218)'%3E%3Crect%20x='-7'%20y='-7'%20width='14'%20height='14'%20rx='2'%20fill='none'%20stroke='%2315b88a'%20stroke-width='2.2'/%3E%3Cline%20x1='-7'%20y1='-2'%20x2='-11'%20y2='-2'%20stroke='%2315b88a'%20stroke-width='2'/%3E%3Cline%20x1='-7'%20y1='3'%20x2='-11'%20y2='3'%20stroke='%2315b88a'%20stroke-width='2'/%3E%3Cline%20x1='7'%20y1='-2'%20x2='11'%20y2='-2'%20stroke='%2315b88a'%20stroke-width='2'/%3E%3Cline%20x1='7'%20y1='3'%20x2='11'%20y2='3'%20stroke='%2315b88a'%20stroke-width='2'/%3E%3C/g%3E%3Ctext%20x='362.0'%20y='214'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='15'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='700'%3E来源不限%3C/text%3E%3Ctext%20x='362.0'%20y='236'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='12.5'%20fill='%235b6b7b'%20text-anchor='start'%20font-weight='400'%3E哪来的包都能装%3C/text%3E%3C/svg%3E)
先判断是权限没收紧，还是安装包在运行时自己偷装，再对症处理，能省掉反复重装系统的功夫。
第1步 先把账户权限和 UAC 收紧
权限太松，安装包一提权就畅通无阻，这一步决定后面所有拦截有没有立足点。
具体操作
- Win+R 输入 UserAccountControlSettings.exe，等同于 控制面板→用户账户→更改用户账户控制设置，把滑块拉到「始终通知」，确定后重启。
- 专业版/企业版：Win+R 输入 gpedit.msc，进 计算机配置→Windows 设置→安全设置→本地策略→安全选项，把「用户账户控制：以管理员批准模式运行所有管理员」设为已启用。
- 家庭版没有 gpedit，Win+R 输入 regedit，定位 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System，确认 EnableLUA 的值是 1。
- 日常上网改成标准账户，只有装东西时才点「是」提权。弹出「此程序被组策略阻止」并显示 0x800704EC，说明拦截策略已经在起作用。
- 别为了少点几次弹窗把 UAC 拉到最低或者关掉。那样任何安装包都能静默落地，后面几步全部失效。
把 UAC 拉到最低、日常挂着管理员账户上网，这两样最容易让拦截形同虚设。日常换成标准账户，只在安装时提权，点「是」之前先看清窗口里的程序名是不是自己要装的那个。
'/%3E%3Crect%20x='28'%20y='64'%20width='262'%20height='142'%20rx='12'%20fill='%23fdeeec'%20stroke='%23e8604c'%20stroke-width='1.5'/%3E%3Crect%20x='28'%20y='64'%20width='262'%20height='42'%20rx='12'%20fill='%23e8604c'/%3E%3Crect%20x='28'%20y='94'%20width='262'%20height='12'%20fill='%23e8604c'/%3E%3Cg%20transform='translate(50,85)'%3E%3Ccircle%20r='12'%20fill='%23ffffff'/%3E%3Cpath%20d='M-5%20-5%20l10%2010%20M5%20-5%20l-10%2010'%20fill='none'%20stroke='%23e8604c'%20stroke-width='2.6'%20stroke-linecap='round'%20stroke-linejoin='round'/%3E%3C/g%3E%3Ctext%20x='70'%20y='91'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='15'%20fill='%23ffffff'%20text-anchor='start'%20font-weight='700'%3E误区%3C/text%3E%3Ccircle%20cx='50'%20cy='126'%20r='3'%20fill='%23e8604c'/%3E%3Ctext%20x='64'%20y='130'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='400'%3E把%20UAC%20拉到最低%3C/text%3E%3Ccircle%20cx='50'%20cy='152'%20r='3'%20fill='%23e8604c'/%3E%3Ctext%20x='64'%20y='156'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='400'%3E日常用管理员账户上网%3C/text%3E%3Ccircle%20cx='50'%20cy='178'%20r='3'%20fill='%23e8604c'/%3E%3Ctext%20x='64'%20y='182'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='400'%3E安装时一路点允许%3C/text%3E%3Crect%20x='310'%20y='64'%20width='262'%20height='142'%20rx='12'%20fill='%23def5ef'%20stroke='%2315b88a'%20stroke-width='1.5'/%3E%3Crect%20x='310'%20y='64'%20width='262'%20height='42'%20rx='12'%20fill='%2315b88a'/%3E%3Crect%20x='310'%20y='94'%20width='262'%20height='12'%20fill='%2315b88a'/%3E%3Cg%20transform='translate(332,85)'%3E%3Ccircle%20r='12'%20fill='%23ffffff'/%3E%3Cpath%20d='M-5%200%20l4%204%20l7%20-8'%20fill='none'%20stroke='%2315b88a'%20stroke-width='2.6'%20stroke-linecap='round'%20stroke-linejoin='round'/%3E%3C/g%3E%3Ctext%20x='352.0'%20y='91'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='15'%20fill='%23ffffff'%20text-anchor='start'%20font-weight='700'%3E正确%3C/text%3E%3Ccircle%20cx='332'%20cy='126'%20r='3'%20fill='%2315b88a'/%3E%3Ctext%20x='346.0'%20y='130'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='400'%3E保持「始终通知」%3C/text%3E%3Ccircle%20cx='332'%20cy='152'%20r='3'%20fill='%2315b88a'/%3E%3Ctext%20x='346.0'%20y='156'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='400'%3E日常用标准账户%3C/text%3E%3Ccircle%20cx='332'%20cy='178'%20r='3'%20fill='%2315b88a'/%3E%3Ctext%20x='346.0'%20y='182'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='400'%3E只在安装时提权%3C/text%3E%3C/svg%3E)
第2步 用本地策略禁止系统静默安装
从系统层面掐掉「不弹界面就把程序装进去」这条路，让每次安装都必须过用户这一关。
具体操作
- Win+R 输入 gpedit.msc，进 计算机配置→管理模板→Windows 组件→Windows Installer。
- 双击「禁止用户安装」，选「已启用」；下面的「隐藏用户安装」按需选「是」，确定后 Win+R 输入 cmd，执行 gpupdate /force 刷新策略。
- 家庭版改注册表：Win+R 输入 regedit，定位 HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer。没有 Installer 项就右键新建一个。
- 在 Installer 项下新建 DWORD(32 位) 值，命名 DisableUserInstalls，数值数据填 1，重启后生效。
- 如果安装程序报错误 2503 或 2502，说明 C:\Windows\Temp 和 %TEMP% 的权限不足，给这两个文件夹补上当前用户的完全控制权限即可。
这条策略的入口不深：Win+R 输入 gpedit.msc，一路点开计算机配置、管理模板、Windows 组件，就能看到 Windows Installer 这一项。改完记得执行一次 gpupdate /force 让它立刻生效，不用等着重启。
'/%3E%3Crect%20x='28'%20y='94'%20width='94'%20height='78'%20rx='12'%20fill='%23ffffff'%20stroke='%2315b88a'%20stroke-width='2'/%3E%3Ccircle%20cx='48'%20cy='94'%20r='15'%20fill='%2315b88a'/%3E%3Ctext%20x='48.0'%20y='99'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%23ffffff'%20text-anchor='middle'%20font-weight='700'%3E1%3C/text%3E%3Ctext%20x='75.2'%20y='129.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='600'%3EWin+R→gpe%3C/text%3E%3Ctext%20x='75.2'%20y='149.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='600'%3Edit.msc%3C/text%3E%3Cpath%20d='M126%20124%20l9%209%20l-9%209'%20fill='none'%20stroke='%2315b88a'%20stroke-width='3'%20stroke-linecap='round'%20stroke-linejoin='round'/%3E%3Crect%20x='140'%20y='94'%20width='94'%20height='78'%20rx='12'%20fill='%23ffffff'%20stroke='%2315b88a'%20stroke-width='2'/%3E%3Ccircle%20cx='160'%20cy='94'%20r='15'%20fill='%2315b88a'/%3E%3Ctext%20x='160.4'%20y='99'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%23ffffff'%20text-anchor='middle'%20font-weight='700'%3E2%3C/text%3E%3Ctext%20x='187.60000000000002'%20y='129.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='600'%3E管理模板→W%3C/text%3E%3Ctext%20x='187.60000000000002'%20y='149.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='600'%3Eindows%20…%3C/text%3E%3Cpath%20d='M239%20124%20l9%209%20l-9%209'%20fill='none'%20stroke='%2315b88a'%20stroke-width='3'%20stroke-linecap='round'%20stroke-linejoin='round'/%3E%3Crect%20x='253'%20y='94'%20width='94'%20height='78'%20rx='12'%20fill='%23ffffff'%20stroke='%2315b88a'%20stroke-width='2'/%3E%3Ccircle%20cx='273'%20cy='94'%20r='15'%20fill='%2315b88a'/%3E%3Ctext%20x='272.8'%20y='99'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%23ffffff'%20text-anchor='middle'%20font-weight='700'%3E3%3C/text%3E%3Ctext%20x='300.0'%20y='129.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='600'%3E定位%20Windo%3C/text%3E%3Ctext%20x='300.0'%20y='149.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='600'%3Ews%20Insta…%3C/text%3E%3Cpath%20d='M351%20124%20l9%209%20l-9%209'%20fill='none'%20stroke='%2315b88a'%20stroke-width='3'%20stroke-linecap='round'%20stroke-linejoin='round'/%3E%3Crect%20x='365'%20y='94'%20width='94'%20height='78'%20rx='12'%20fill='%23ffffff'%20stroke='%2315b88a'%20stroke-width='2'/%3E%3Ccircle%20cx='385'%20cy='94'%20r='15'%20fill='%2315b88a'/%3E%3Ctext%20x='385.20000000000005'%20y='99'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%23ffffff'%20text-anchor='middle'%20font-weight='700'%3E4%3C/text%3E%3Ctext%20x='412.40000000000003'%20y='129.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='600'%3E启用「禁止%3C/text%3E%3Ctext%20x='412.40000000000003'%20y='149.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='600'%3E用户安装」%3C/text%3E%3Cpath%20d='M464%20124%20l9%209%20l-9%209'%20fill='none'%20stroke='%2315b88a'%20stroke-width='3'%20stroke-linecap='round'%20stroke-linejoin='round'/%3E%3Crect%20x='478'%20y='94'%20width='94'%20height='78'%20rx='12'%20fill='%2315b88a'%20stroke='%2315b88a'%20stroke-width='2'/%3E%3Ccircle%20cx='498'%20cy='94'%20r='15'%20fill='%230a9472'/%3E%3Ctext%20x='497.6'%20y='99'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%23ffffff'%20text-anchor='middle'%20font-weight='700'%3E5%3C/text%3E%3Ctext%20x='524.8000000000001'%20y='129.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%23ffffff'%20text-anchor='middle'%20font-weight='600'%3Egpupdate%20/%3C/text%3E%3Ctext%20x='524.8000000000001'%20y='149.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='14'%20fill='%23ffffff'%20text-anchor='middle'%20font-weight='600'%3Eforce%3C/text%3E%3C/svg%3E)
用「软领Windows优化大师」更省事
「禁止安装」管的是安装包运行时偷装东西这一环：安装动作一发生就把它拦下来，不用靠一组组策略和注册表开关去层层堵漏。策略打开后又被某个软件改回去的情况，用它兜底更省心。
软件管理把装进来的程序集中在一处，能按安装日期核对、直接卸载，省去在设置列表里逐个翻找、再钻注册表清启动项的来回折腾。
软领是知名国产软件品牌，20 年技术沉淀，服务千万用户。到软领官网 wyouhua.com 直接下载，安装过程没有捆绑勾选项；软件里可点客服按钮联系真人客服，情况复杂的有工程师远程协助。
第3步 打开系统自带的应用安装拦截
把「应用和浏览器控制」这道闸门打开，不明来源的安装包在运行前就会被系统挡下。
具体操作
- Win+R 输入 windowsdefender:，打开 Windows 安全中心，进「应用和浏览器控制」。
- 先把「基于声誉的保护」下的「阻止可能不需要的应用」打开，它专门盯被捆绑进来的推广类程序。
- Win11 再看「智能应用控制」：能选就设为「打开」。显示灰色说明系统是升级上来的或者此前关过，要重置、重装系统后才可用。
- 想按白名单收口：Win+R 输入 gpedit.msc，进 计算机配置→Windows 设置→安全设置→应用程序控制策略→AppLocker→可执行规则，右键「创建默认规则」。
- 拦截生效时会弹出「Windows 已保护你的电脑」。对应记录在 Win+R 输入 eventvwr.msc，进 应用程序和服务日志→Microsoft→Windows→AppLocker 里查。
「阻止可能不需要的应用」、Win11 的「智能应用控制」、组策略里的 AppLocker 规则，这几处互不冲突，可以一起开着。打开之后，来源不明的包在双击那一刻就会被系统拦停。
'/%3E%3Crect%20x='236'%20y='68'%20width='128'%20height='84'%20rx='16'%20fill='url(%23vg)'/%3E%3Ctext%20x='300.0'%20y='116.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='15'%20fill='%23ffffff'%20text-anchor='middle'%20font-weight='700'%3E安全中心%3C/text%3E%3Crect%20x='28'%20y='64'%20width='168'%20height='36'%20rx='18'%20fill='%23ffffff'%20stroke='%2315b88a'%20stroke-width='1.6'/%3E%3Ccircle%20cx='46'%20cy='82'%20r='5'%20fill='%2315b88a'/%3E%3Ctext%20x='62'%20y='87.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='12.5'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='600'%3E应用和浏览器控制%3C/text%3E%3Cpath%20d='M196%2082%20Q216%2082%20236%20110'%20fill='none'%20stroke='%2315b88a'%20stroke-width='1.4'%20opacity='0.5'/%3E%3Crect%20x='28'%20y='120'%20width='168'%20height='36'%20rx='18'%20fill='%23ffffff'%20stroke='%2315b88a'%20stroke-width='1.6'/%3E%3Ccircle%20cx='46'%20cy='138'%20r='5'%20fill='%2315b88a'/%3E%3Ctext%20x='62'%20y='143.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='12.5'%20fill='%231f2d3d'%20text-anchor='start'%20font-weight='600'%3E智能应用控制%3C/text%3E%3Cpath%20d='M196%20138%20Q216%20138%20236%20110'%20fill='none'%20stroke='%2315b88a'%20stroke-width='1.4'%20opacity='0.5'/%3E%3Crect%20x='404'%20y='92'%20width='168'%20height='36'%20rx='18'%20fill='%23ffffff'%20stroke='%2315b88a'%20stroke-width='1.6'/%3E%3Ccircle%20cx='554'%20cy='110'%20r='5'%20fill='%2315b88a'/%3E%3Ctext%20x='538'%20y='115.0'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='12.5'%20fill='%231f2d3d'%20text-anchor='end'%20font-weight='600'%3EAppLocker%3C/text%3E%3Cpath%20d='M404%20110%20Q384%20110%20364%20110'%20fill='none'%20stroke='%2315b88a'%20stroke-width='1.4'%20opacity='0.5'/%3E%3C/svg%3E)
第4步 盯住安装包运行时放出来的程序
很多捆绑不在安装界面的勾选项里，而是安装过程中静默下载并执行的，必须在这一步盯住。
具体操作
- 装之前先把浏览器的下载项设置改掉：取消「下载完成后自动打开文件」，改成每次询问保存位置，别让包一落地就自动运行。
- 运行安装包时选「自定义安装」，逐个取消预勾选。界面上带「推荐」「立即体验」「同意安装」这类字样的复选框一律清空再点下一步。
- 安装同时按 Ctrl+Shift+Esc 打开任务管理器，切到「详细信息」，留意新冒出来的 exe。Win+R 输入 %temp% 看有没有新落地的安装包，再到 C:\Users\<用户名>\AppData\Local\Temp 对照一遍。
- 装完立刻进 设置→应用→已安装的应用，按「安装日期」排序核对多出来的条目；Win+R 输入 services.msc 检查新增服务；任务管理器→启动应用检查自启项。
- 发现可疑进程先别急着结束，右键「打开文件所在位置」记下路径，再回到这个文件夹做后续处理。
安装包运行可以拆成下载前、安装中、安装后三段来看：下载前管住自动打开，安装中盯着预勾选项，安装后核对启动项和服务。漏网的捆绑程序基本都会在这三段里露头。
'/%3E%3Cline%20x1='44'%20y1='134'%20x2='556'%20y2='134'%20stroke='%23dbe3ec'%20stroke-width='3'/%3E%3Ccircle%20cx='44'%20cy='134'%20r='9'%20fill='%23ffffff'%20stroke='%2315b88a'%20stroke-width='3'/%3E%3Ccircle%20cx='44'%20cy='134'%20r='3.5'%20fill='%2315b88a'/%3E%3Ctext%20x='44.0'%20y='104'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13.5'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='700'%3E下载前%3C/text%3E%3Ctext%20x='44.0'%20y='86'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='11.5'%20fill='%235b6b7b'%20text-anchor='middle'%20font-weight='400'%3E关掉自动打开%3C/text%3E%3Ccircle%20cx='300'%20cy='134'%20r='9'%20fill='%23ffffff'%20stroke='%2315b88a'%20stroke-width='3'/%3E%3Ccircle%20cx='300'%20cy='134'%20r='3.5'%20fill='%2315b88a'/%3E%3Ctext%20x='300.0'%20y='174'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13.5'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='700'%3E安装中%3C/text%3E%3Ctext%20x='300.0'%20y='192'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='11.5'%20fill='%235b6b7b'%20text-anchor='middle'%20font-weight='400'%3E选自定义安装%3C/text%3E%3Ccircle%20cx='556'%20cy='134'%20r='9'%20fill='%2315b88a'/%3E%3Cpath%20d='M552%20134%20l3%203%20l5%20-6'%20fill='none'%20stroke='%23ffffff'%20stroke-width='2'%20stroke-linecap='round'%20stroke-linejoin='round'/%3E%3Ctext%20x='556.0'%20y='104'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13.5'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='700'%3E安装后%3C/text%3E%3Ctext%20x='556.0'%20y='86'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='11.5'%20fill='%235b6b7b'%20text-anchor='middle'%20font-weight='400'%3E查启动项服务%3C/text%3E%3C/svg%3E)
第5步 验证拦截是否生效，并清理漏网的
不复测就不知道策略是拦住了还是被绕过去了，已经进来的还要按安装日期和启动项反查清干净。
具体操作
- 拿一个已知会捆绑的安装包实测：应该停在「Windows 已保护你的电脑」或者智能应用控制的阻止提示上。如果照装不误，回到第2步确认 DisableUserInstalls 的值有没有被别处改回 0。
- Win+R 输入 eventvwr.msc，进 Windows 日志→应用程序，按来源 MsiInstaller、SmartScreen、AppLocker 筛选，看每次安装动作有没有留下记录。
- 已经装进来的：设置→应用→已安装的应用里逐个卸载；再 Win+R 输入 regedit，检查 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 和 HKCU 下的同名键，删掉残留项。
- 收口习惯：安装包固定从官网下载，放在固定目录（比如 D:\Setup），下载后右键→属性→数字签名确认来源，来源不明的包先查再装。
- 如果策略误拦了自己要用的正规软件，回到 gpedit.msc 把「禁止用户安装」改回「未配置」，执行 gpupdate /force 后再装。
拦没拦住，看结果就能分辨：弹出阻止提示并记进事件日志，是策略在干活；静默装完没有任何提示，多半是权限或者 DisableUserInstalls 被改回去了。
'/%3E%3Crect%20x='230'%20y='82'%20width='140'%20height='44'%20rx='10'%20fill='%2315b88a'/%3E%3Ctext%20x='300.0'%20y='110'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='15'%20fill='%23ffffff'%20text-anchor='middle'%20font-weight='700'%3E装包被拦%3C/text%3E%3Cpath%20d='M300%20126%20C300%20174%2045%20132%2045%20184'%20fill='none'%20stroke='%2315b88a'%20stroke-width='2'/%3E%3Crect%20x='-13'%20y='184'%20width='116'%20height='46'%20rx='10'%20fill='%23def5ef'%20stroke='%2315b88a'%20stroke-width='1.8'/%3E%3Ctext%20x='45.0'%20y='212'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13.5'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='600'%3E弹窗提示已阻止%3C/text%3E%3Cpath%20d='M300%20126%20C300%20174%20555%20132%20555%20184'%20fill='none'%20stroke='%23e8604c'%20stroke-width='2'/%3E%3Crect%20x='497'%20y='184'%20width='116'%20height='46'%20rx='10'%20fill='%23fdeeec'%20stroke='%23e8604c'%20stroke-width='1.8'/%3E%3Ctext%20x='555.0'%20y='212'%20font-family='Segoe%20UI,Microsoft%20YaHei,PingFang%20SC,sans-serif'%20font-size='13.5'%20fill='%231f2d3d'%20text-anchor='middle'%20font-weight='600'%3E静默装完没提示%3C/text%3E%3C/svg%3E)
大家常问
Windows 11 智能应用控制是灰色的，捆绑安装拦截还能开启吗？
灰色表示这项功能在你现在的系统上不可用，一般是升级安装或者此前关过留下的状态，只能重置、重装系统之后才会亮起。这段时间用「阻止可能不需要的应用」加组策略里的 AppLocker 顶上，拦截照样有效。
gpedit.msc 打不开，家庭版怎么禁止软件静默安装？
家庭版没有组策略编辑器，改注册表就行。定位到 HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer，新建 DWORD(32 位) 值 DisableUserInstalls，数值数据填 1，重启生效。
设置了禁止安装还是被静默装机，提示 0x800704EC 是什么原因？
0x800704EC 表示程序被组策略挡住了，策略本身是生效的。如果仍被装上，多半是那个程序走服务或驱动通道落地，绕开了 Windows Installer 这条路径，这类要配合「阻止可能不需要的应用」和安装后核对服务来收口。
安装时提示错误 2503 或 2502，和捆绑拦截设置有关系吗？
没有直接关系。这是 C:\Windows\Temp 和 %TEMP% 的权限不足造成的，给这两个文件夹补上当前用户的完全控制权限，再重新运行安装程序即可。
已经装上的捆绑软件和它的启动项怎么彻底清干净？
先在 设置→应用→已安装的应用 里卸载，再 Win+R 输入 regedit，检查 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 和 HKCU 下的同名键删掉残留项，最后在任务管理器→启动应用里禁用多余自启。
推荐阅读
相关推荐
阻止软件捆绑安装禁止电脑自动安装软件拦截静默安装软领Windows优化大师 
提示