How to create a whitelist for launching applications?

Question

Group Policies

Good afternoon.
Tell me, please, how can I implement white lists of startup applications in Windows7 included in the domain under windows2008r2? In the Group Policy Editor, I found the applocker item, but as far as I understand it works in 3 modes:
1) Publisher, i.e. I select an exe-file, it rips out (if it can) the necessary data and blocks it. - This item seems to suit me, but I can only specify those applications that are installed on the server. And on user PCs, there are completely different and different applications that need to be allowed.
2) The path is not very suitable, because the user can move his file to this folder and execute it there. But on the other hand, I can specify the paths to applications that exist on users' PCs
3) Hash - not suitable, because applications can be updated and the hash changes accordingly. But again, I can specify the hash of applications that exist on users' PCs.
I liked the parental control in Win7, but when I turned it on to a domain, it disappeared.
Are there any solutions that could create a white list of startup applications?