Problems in config software restriction policy to restrict all apps

[gkartikrj]

I don't want any standard user to run any application expect those which are already installed, so I created a path rule in software restriction policy and disallowed all applications (.exe, .msi & .msp) except those which are present in windows & program files folder. But problem is that some applications (like Matlab) require access to PROGRAM DATA (like Java) and APP DATA FOLDER which contain many executables. If I allow those folders, standard users are able to copy any portable application into those folder & run it from there. That means users are able to write into those folders.
However, I can create path rule for all executables present in those folders and allow them, but they too many of them, so its not convenient to create rules one by one.
Also I have personal folder in Local Drive (D) which contains some useful portable applications, so I want to allow that folder and at same time make it write protected so that standard user cannot copy any other application and run it at their own will.
Any solution?
System Details:
Windows 7 Ultimate 32 bit service pack 1

 

[samuria]

Welcome to the forum. Is this a home pc or work? It depends what the files are and what they do you could just set the folder to read and exicutebut no write but that depends if any config is saved in any of the files

 

[gkartikrj]

Its my home PC and there are executable files in Program Data and App Data folder. The problem is that they are already set to 'no write' and still users are able to copy files into it, whereas the same configuration is for Program Files folder and standard users are not allowed to write anything into it.