Software restriction policies provide a useful protection against malware. They do this by preventing executables from being launched from places where malware would typically arrive on the computer, such as download folders within the user-profile, temporary-file folders and USB memory. An additional benefit is the ability to block the installation of unwanted software from auto-running product CDs etc. Whilst you can achieve the same result with Group Policy, doing so is by no means easy