In our environment, they have enabled Software Restriction Policy to block any executable to be run, except in trusted (and read-only) locations.

That is a pretty effective way to prevent unwanted software to be installed / run.