Make sure "Enable Controlled folder access" policy settings is disabled. This
blocks the installation of all the MSI packages that contain a desktop shortcut.