Use Microsoft AppLocker in combination with VMware Workspace ONE UEM for none domain join laptops to allowed users to launch .EXE files only from Program Files and Windows directory and Administrators to be allowed to launch .EXE files in all directories. In this video I show you how to configure it.
