Oh, it's messy. In brief, if any of the said applications require Registry entry, it denies that through the permission model that these systems have installed

Oh, it's messy. In brief, if any of the said applications require Registry entry, it denies that through the permission model that these systems have installed. If it requires altering some files under some directory, it denies that as well. Some corporations even restrict such shady websites altogether using an exhaustive list of restricted domains and subdomains, often maintained by a third party, who do this list maintenance full-time for corporates like IBM, TCS, just to name a few. On top of it, almost all network and device activities are tracked, flash drive ports disabled, etc. to ensure "security". (Only a handful of underpaid device managers have access to Admin account. Forget the fact that this still doesn't prevent them from doing so at their discretion, or credentials sharing)