I know Windows 10 has a lockdown option, to forbid running unsigned code. But in my organization, I'd get shot if I tried to do that. So I'd like the next best thing: a remote alert whenever unsigned code is run. Does Windows have a way to do that?
I'd also really like either Windows itself, or Defender, to have an option to add custom malware definitions, so I can add definitions for crap (even though technically not malware) that people aren't supposed to be installing (regardless of whether it's signed). For this too, I'd get shot if I configured our systems to automatically block/delete the crap, but I'd at least like to get an alert. See my related question: Can I configure Windows Defender to reject competing AV programs?