exe 禁运

gpedit.msc

Computer Configuration > 
    Windows Settings > 
        Security Settings > 
            Software Restriction Policies

• At the location, on the left navigation pane, click the Software Restriction Policies folder to collapse it.

• Next, right-click the Additional Rules folder node.

• Select New Path Rule… from the context menu.

• Now, enter the path to the folder that you want to prevent executable files to run from and make sure to suffix the *.exe at the end, so that you will only block executable files.

• Add a description if you like.

• Click Apply > OK to save the changes.

Repeat for additional folders.

ref https://www.thewindowsclub.com/