I'm going to prevent users from running executable files, what are the ways to make exceptions?

Question

System administration

I want to prohibit the launch of executable files, starting with a complete ban and then exposing exceptions. From what locations can you immediately allow programs to run?

C:\ProgramData
C:\Program Files
C:\Program Files (x86)

something else to work?

Answer 1

Maybe just enter a white list of those programs that can be run, and prohibit everything that is not on the white list pointwise?
There shouldn't be any executables in ProgramData.
What programs your users use for work - only these users know.
So you need to look where they start from there.

Answer 2

Have you looked at Software Restriction Policies ?