A manufacturing company has experienced repeated incidents where employees inadvertently install unapproved software downloaded from the internet, some of which was later found to contain malware. Management wants to ensure that only explicitly approved executables can run on company workstations, regardless of what a user attempts to launch. Which mitigation technique BEST meets this requirement?