Software Restriction Policy (SRP) when set up correctly can greatly enhance security.
The following links will help you in doing so:
- http://mechbgon.com/srp/ (The main point is: Remove LNK from the list of checked files)
- https://docs.microsoft.com/de-de/sysinternals/downloads/accesschk (Check for Write XOR Execute)
- https://technet.microsoft.com/en-us/library/dn449105(v=ws.11).aspx (Microsoft's documentation for SRP on the client, outdated but still valid)
- https://technet.microsoft.com/de-de/library/2008.06.srp.aspx?pr=blog (Some old blog post that describes how SRP works)