You can use software restriction policies in two ways:
To prevent users from running specific applications. This corresponds to the default policy of Unrestricted and is useful for typical users and computers.
To lock down systems so that users can run only applications that you specifically allow. This corresponds to the default policy of Disallowed and is useful for low-security user accounts, Terminal Servers, and public kiosks.
Software restriction policies are not a substitute for antivirus programs or firewalls. Imprudently used, software restriction policies can add significantly to the workload of administrators and Help desk personnel and seriously irritate end users. So employ software restriction policies ...