some programs, including some Microsoft developed ones, will install into %appdata% to bypass the need to have local admin rights to install for all users. On one hand it's handy. On the other it makes blocking users from installing shit more of a pain

Well on windows you can install shit anywhere, I don't know if there is something similar to linux's noexec (but that is handled at mount point level). In the old days I used to have a usb drive with "portable" versions of the applications that I wanted to use at school. (We weren't obviously allowed to install anything, but you could run anything)

Anyways, security is hard, windows is confusing 👍