Message #1513

[Defcon 5]

System Key: [HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer]
Value Name: DisableMSI
Data Type: REG_DWORD (DWORD Value)
Value Data: (0 = default, 1 = admin only, 2 = disabled)

That will stop users installing msi installers (i think).

EDIT: you must reboot or log out and in for it to take effect.