I was looking here
Now, it sounds promising to be able to restrict where programs are executed from, making sure they only execute from %PROGFILES% and %WINDIR%, but I have to wonder how enforceable and lock-downable that is to do. Assuming that page is followed, and there are no current vulnerabilities(only for the purposes of my question).
Can you ensure that programs can't be executed from %TEMP%, that programs couldn't just be launched from cmd or start commands, or from within other programs? Basically, are there any ways around this, and if so, how too could you lock them down?