Log on with an Administrator account. Click Start > Run, type gpedit.msc in the Run box, click OK, and Group Policy will open.
Go down to Computer Configuration > Windows Settings > Security Settings, as shown in the picture below.
Right-click on "Software Restriction Policies" and create new policies.
Step 2: Apply the Software Restriction Policy to all software, and to all users except Administrators
Double-click Enforcement and set the Enforcement like shown below. You could apply the Software Restriction Policy to all users including Administrators, but then you'd run into occasional hangups when installing/removing software.
Step 3: Remove the LNK filetype
Right-click on Disallowed in the Security Levels folder, and set it as the default security level