In our environment, they have enabled Software Restriction Policy to block any executable to be run, except in trusted (and read-only) locations.
That is a pretty effective way to prevent unwanted software to be installed / run.
That is a pretty effective way to prevent unwanted software to be installed / run.
In a corporate environment in many cases it is undesired that users install applications. So of course one disables Windows Store. Additionally one prohibits downloading zips etc. I have read of a way how in Windows one can set that files created/downloaded by users cannot be executed, which is also a desired configuration in many corporate environments.