There&#x27;s actually a Windows feature intended to mitigate this, that was added sometime around Server 2003, but it&#x27;s never turned on by default because of backwards compatibility issues.  Look under &#x27;Windows Settings\Security Settings\Software Restriction Policies&#x27; in a GPO to see it.