In our environment, they have enabled Software Restriction Policy to block any executable to be run, except in trusted (and read-only) locations. That is a pre

In our environment, they have enabled Software Restriction Policy to block any executable to be run, except in trusted (and read-only) locations. That is a pretty effective way to prevent unwanted software to be installed / run.