Creating a user account that does not allow downloads

My mother downloaded a virus to her computer. I want to prevent this from happening again so I want to create a user account that does not allow downloading of anything.

From what I read, a Standard account will not allow any type of downloading or installation.

However I was able to download and install Windows Essentials while logged into her account. Why is this?

Someone suggested the following. Would this work?

To disable UAC prompt and deny admin rights all together, set "Local Policies \ Security Options \ User Account Control: Behavior of the elevation prompt for standard users" to "Automatically deny elevation requests" in security policy.

Where do I access Security Policy?

A Standard account doesn't block internet access. You could create a Child account and see if the restrictions are adequate for your needs. See https://www.tenforums.com/tutorials/3...dows-10-a.html and https://support.microsoft.com/en-us/...t-child-limits