[GPO] Add GPO to disable per-user install

doc/gpo/README.md

@@ -44,6 +44,22 @@ If this setting is not configured, experimentation is allowed.
 
 ### Installer and Updates
 
+#### Disable per-machine installation
+
+This policy configures whether PowerToys per-machine installation is allowed or not.
+
+If enabled, per-machine installation is not allowed.
+
+If disabled or not configured, per-machine installation is allowed.
+
+#### Disable per-user installation
+
+This policy configures whether PowerToys per-user installation is allowed or not.
+
+If enabled, per-user installation is not allowed.
+
+If disabled or not configured, per-user installation is allowed.
+
 #### Disable automatic downloads
 
 This policy configures whether automatic downloads of available updates are disabled or not. (On metered connections updates are never downloaded.)

installer/PowerToysSetup/Product.wxs

@@ -148,6 +148,9 @@
       <Custom Action="RegisterPowerToysSchTask" After="InstallFiles">
         NOT Installed and CREATESCHEDULEDTASK = 1
       </Custom>
+      <Custom Action="CheckGPO" After="InstallInitialize">
+        NOT Installed
+      </Custom>
       <Custom Action="ApplyModulesRegistryChangeSets" After="InstallFiles">
         NOT Installed
       </Custom>
@@ -413,6 +416,13 @@
                 DllEntry="UnRegisterContextMenuPackagesCA"
                   />
 
+    <CustomAction Id="CheckGPO"
+                  Return="check"
+                  Impersonate="yes"
+                  BinaryKey="PTCustomActions"
+                  DllEntry="CheckGPOCA"
+                  />
+
     <!-- Close 'PowerToys.exe' before uninstall-->
     <Property Id="MSIRESTARTMANAGERCONTROL" Value="DisableShutdown" />
     <Property Id="MSIFASTINSTALL" Value="DisableShutdown" />

installer/PowerToysSetupCustomActions/CustomAction.cpp

@@ -6,6 +6,7 @@
 #include <spdlog/sinks/base_sink.h>
 
 #include "../../src/common/logger/logger.h"
+#include "../../src/common/utils/gpo.h"
 #include "../../src/common/utils/MsiUtils.h"
 #include "../../src/common/utils/modulesRegistry.h"
 #include "../../src/common/updating/installer.h"
@@ -50,6 +51,43 @@ HRESULT getInstallFolder(MSIHANDLE hInstall, std::wstring& installationDir)
 LExit:
     return hr;
 }
+
+UINT __stdcall CheckGPOCA(MSIHANDLE hInstall)
+{
+    HRESULT hr = S_OK;
+
+    hr = WcaInitialize(hInstall, "CheckGPOCA");
+    ExitOnFailure(hr, "Failed to initialize");
+
+    LPWSTR currentScope = nullptr;
+    hr = WcaGetProperty(L"InstallScope", &currentScope);
+
+    if(std::wstring{ currentScope } == L"perUser")
+    {
+        if (powertoys_gpo::getDisablePerUserInstallationValue() == powertoys_gpo::gpo_rule_configured_enabled)
+        {
+            PMSIHANDLE hRecord = MsiCreateRecord(0);
+            MsiRecordSetString(hRecord, 0, TEXT("The system administrator has disabled per-user installation."));
+            MsiProcessMessage(hInstall, static_cast<INSTALLMESSAGE>(INSTALLMESSAGE_ERROR + MB_OK), hRecord);
+            hr = E_ABORT;
+        }
+    }
+    if(std::wstring{ currentScope } == L"perMachine")
+    {
+        if (powertoys_gpo::getDisablePerMachineInstallationValue() == powertoys_gpo::gpo_rule_configured_enabled)
+        {
+            PMSIHANDLE hRecord = MsiCreateRecord(0);
+            MsiRecordSetString(hRecord, 0, TEXT("The system administrator has disabled per-machine installation."));
+            MsiProcessMessage(hInstall, static_cast<INSTALLMESSAGE>(INSTALLMESSAGE_ERROR + MB_OK), hRecord);
+            hr = E_ABORT;
+        }
+    }
+
+LExit:
+    UINT er = SUCCEEDED(hr) ? ERROR_SUCCESS : ERROR_INSTALL_FAILURE;
+    return WcaFinalize(er);
+}
+
 UINT __stdcall ApplyModulesRegistryChangeSetsCA(MSIHANDLE hInstall)
 {
     HRESULT hr = S_OK;

installer/PowerToysSetupCustomActions/CustomAction.def

@@ -1,6 +1,7 @@
 LIBRARY "PowerToysSetupCustomActions"
 
 EXPORTS
+	CheckGPOCA
 	ApplyModulesRegistryChangeSetsCA
 	CreateScheduledTaskCA
 	CreateWinAppSDKHardlinksCA

src/common/utils/gpo.h

@@ -51,6 +51,8 @@ namespace powertoys_gpo {
     const std::wstring POLICY_CONFIGURE_ENABLED_REGISTRY_PREVIEW = L"ConfigureEnabledUtilityRegistryPreview";
 
     // The registry value names for PowerToys installer and update policies.
+    const std::wstring POLICY_DISABLE_PER_MACHINE_INSTALLATION = L"PerMachineInstallationDisabled";
+    const std::wstring POLICY_DISABLE_PER_USER_INSTALLATION = L"PerUserInstallationDisabled";
     const std::wstring POLICY_DISABLE_AUTOMATIC_UPDATE_DOWNLOAD = L"AutomaticUpdateDownloadDisabled";
     const std::wstring POLICY_SUSPEND_NEW_UPDATE_TOAST = L"SuspendNewUpdateAvailableToast";
     const std::wstring POLICY_DISABLE_PERIODIC_UPDATE_CHECK = L"PeriodicUpdateCheckDisabled";
@@ -260,6 +262,17 @@ namespace powertoys_gpo {
     {
         return getConfiguredValue(POLICY_CONFIGURE_ENABLED_REGISTRY_PREVIEW);
     }
+
+    inline gpo_rule_configured_t getDisablePerMachineInstallationValue()
+    {
+        return getConfiguredValue(POLICY_DISABLE_PER_MACHINE_INSTALLATION);
+    }
+
+    inline gpo_rule_configured_t getDisablePerUserInstallationValue()
+    {
+        return getConfiguredValue(POLICY_DISABLE_PER_USER_INSTALLATION);
+    }
+
     inline gpo_rule_configured_t getDisableAutomaticUpdateDownloadValue()
     {
         return getConfiguredValue(POLICY_DISABLE_AUTOMATIC_UPDATE_DOWNLOAD);

src/gpo/assets/PowerToys.admx

@@ -319,7 +319,27 @@
         <decimal value="0" />
       </disabledValue>
     </policy>
-	<policy name="DisableAutomaticUpdateDownload" class="Both" displayName="$(string.DisableAutomaticUpdateDownload)" explainText="$(string.DisableAutomaticUpdateDownloadDescription)" key="Software\Policies\PowerToys" valueName="AutomaticUpdateDownloadDisabled">
+	  <policy name="DisablePerMachineInstallation" class="Both" displayName="$(string.DisablePerMachineInstallation)" explainText="$(string.DisablePerMachineInstallationDescription)" key="Software\Policies\PowerToys" valueName="PerMachineInstallationDisabled">
+      <parentCategory ref="InstallerUpdates" />
+      <supportedOn ref="SUPPORTED_POWERTOYS_0_69_0" />
+      <enabledValue>
+        <decimal value="1" />
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0" />
+      </disabledValue>
+    </policy>
+	  <policy name="DisablePerUserInstallation" class="Both" displayName="$(string.DisablePerUserInstallation)" explainText="$(string.DisablePerUserInstallationDescription)" key="Software\Policies\PowerToys" valueName="PerUserInstallationDisabled">
+      <parentCategory ref="InstallerUpdates" />
+      <supportedOn ref="SUPPORTED_POWERTOYS_0_69_0" />
+      <enabledValue>
+        <decimal value="1" />
+      </enabledValue>
+      <disabledValue>
+        <decimal value="0" />
+      </disabledValue>
+    </policy>
+	  <policy name="DisableAutomaticUpdateDownload" class="Both" displayName="$(string.DisableAutomaticUpdateDownload)" explainText="$(string.DisableAutomaticUpdateDownloadDescription)" key="Software\Policies\PowerToys" valueName="AutomaticUpdateDownloadDisabled">
       <parentCategory ref="InstallerUpdates" />
       <supportedOn ref="SUPPORTED_POWERTOYS_0_68_0" />
       <enabledValue>
@@ -329,7 +349,7 @@
         <decimal value="0" />
       </disabledValue>
     </policy>
-	<policy name="SuspendNewUpdateToast" class="Both" displayName="$(string.SuspendNewUpdateToast)" explainText="$(string.SuspendNewUpdateToastDescription)" key="Software\Policies\PowerToys" valueName="SuspendNewUpdateAvailableToast">
+	  <policy name="SuspendNewUpdateToast" class="Both" displayName="$(string.SuspendNewUpdateToast)" explainText="$(string.SuspendNewUpdateToastDescription)" key="Software\Policies\PowerToys" valueName="SuspendNewUpdateAvailableToast">
       <parentCategory ref="InstallerUpdates" />
       <supportedOn ref="SUPPORTED_POWERTOYS_0_68_0" />
       <enabledValue>

src/gpo/assets/en-US/PowerToys.adml

@@ -30,6 +30,18 @@ If you enable this setting, the utility will be always enabled and the user won'
 If you disable this setting, the utility will be always disabled and the user won't be able to enable it.
 
 If you don't configure this setting, users are able to disable or enable the utility.
+</string>
+      <string id="DisablePerMachineInstallationDescription">This policy configures whether per-machine PowerToys installation is allowed or not.
+
+If enabled, per-machine installation is not allowed.
+
+If disabled or not configured, per-machine installation is allowed.
+</string>
+      <string id="DisablePerUserInstallationDescription">This policy configures whether per-user PowerToys installation is allowed or not.
+
+If enabled, per-user installation is not allowed.
+
+If disabled or not configured, per-user installation is allowed.
 </string>
       <string id="DisableAutomaticUpdateDownloadDescription">This policy configures whether automatic downloads of available updates are disabled or not. (On metered connections updates are never downloaded.)
 
@@ -87,9 +99,11 @@ If this setting is disabled, experimentation is not allowed.
       <string id="ConfigureEnabledUtilityShortcutGuide">Shortcut Guide: Configure enabled state</string>
       <string id="ConfigureEnabledUtilityTextExtractor">Text Extractor: Configure enabled state</string>
       <string id="ConfigureEnabledUtilityVideoConferenceMute">Video Conference Mute: Configure enabled state</string>
-	  <string id="DisableAutomaticUpdateDownload">Disable automatic downloads</string>
-	  <string id="SuspendNewUpdateToast">Suspend Action Center notification for new updates</string>
-	  <string id="DisablePeriodicUpdateCheck">Disable automatic update checks</string>
+      <string id="DisablePerMachineInstallation">Disable per-machine installation</string>
+      <string id="DisablePerUserInstallation">Disable per-user installation</string>
+      <string id="DisableAutomaticUpdateDownload">Disable automatic downloads</string>
+      <string id="SuspendNewUpdateToast">Suspend Action Center notification for new updates</string>
+      <string id="DisablePeriodicUpdateCheck">Disable automatic update checks</string>
       <string id="AllowExperimentation">Allow Experimentation</string>
     </stringTable>
   </resources>