There's actually a Windows feature intended to mitigate this, that was added sometime around Server 2003, but it's never turned on by default because of backwar

There's actually a Windows feature intended to mitigate this, that was added sometime around Server 2003, but it's never turned on by default because of backwards compatibility issues. Look under 'Windows Settings\Security Settings\Software Restriction Policies' in a GPO to see it.