Because you can add the signing cert to your AppLocker whitelist, and now it will be checked every time it runs. Then you push that out by GPO, and now everyone

Because you can add the signing cert to your AppLocker whitelist, and now it will be checked every time it runs. Then you push that out by GPO, and now everyone has that same whitelist protection. Also, as mentioned other places on the thread, the downloads are over HTTPS. Edit: see the following https://technet.microsoft.com/en-us/library/dd723683(v=ws.10).aspx https://technet.microsoft.com/en-us/library/dd723683(v=ws.10...