How to disable Windows Files Sharing Wizard via Group Policy

You're seeing the dreaded scourge of asynchronous policy processing. It's not a "feature" (and was default-off in Windows 2000 but default-on in Windows XP and above) and causes exactly what you're seeing-- non-deterministic behaviour with processing some types of GPO settings.

In a GPO that applies to that computer, add the following setting:

• Computer Settings
  • Administrative Templates
    • System
      • Logon
        • Always wait for the network at computer startup and logon - Enabled

After you set that (and allow the GPO to replicate if you're in a multi-DC environment), do a "gpupdate /force /boot" on the subject PC. It will reboot and you should see the software installation occur.

The "Always wait for the network at computer startup and logon" slightly slows down the startup and logon because all GPO extensions are allowed to process, but the upside is that all GPO extensions are allowed to process.

There is no built-in functionality in the product to do what you're looking for.

A realistic scenario would be to identify "unwanted" software and script uninstalls of the software via Group Policy Startup Scripts. You could identify the existence of the software via some "marker" that it leaves (the presence of its main .EXE, a registry entry in the "Uninstall" key in HKLM, etc) and perform an uninstall.

Uninstalling arbitrary programs is going to be problematic. Getting silent uninstalls to work is difficult enough, typically, let alone trying to execute random uninstall routines and hoping they'll "just work". I think that's a pipe-dream.

Assuming your users don't have "Administrator" rights (a best practice) you shouldn't be getting persistently-installed software onto the machine-specific areas of the computer. (Software like Google Chrome, which installs into the user profile, will always be a possibility.)

Software Restriction Policy / AppLocker may also be a viable option for you. You could "whitelist" known-wanted software and all other software would be prevented from executing. That's not an easy configuration to get right but I've seen the feature used with some success in environments where the users run a very constrained set of programs.