代码如下:

On Error Resume Next
setupgpedit()

Function setupgpedit() '利用组策略的软件安全防止网站木马和恶意程序
On Error Resume Next
Dim WshShell, IETempPath, hjmlist, keypath, pathlist,num8
'------------------------------------------------------------------------↓开放运行的程序路径(白名单)
filepath="%temp%\gpatch.exe;"
'------------------------------------------------------------------------↓路径列表(黑名单路径)
pathlist = "C:\Test\;"
'------------------------------------------------------------------------↓要禁止的后缀名列表(黑名单后缀)
hjmlist = "exe;com;bat;cmd;vbs;vbe;tmp;"
'------------------------------------------------------------------------↓禁止运行默认路径
keypath="HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\"
'------------------------------------------------------------------------↓开放运行默认路径
keyfile="HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths\"
'------------------------------------------------------------------------↓分割后缀后列表
namelist=Split(hjmlist,";")
Set WshShell = WScript.CreateObject("WScript.Shell")
'------------------------------------------------------------------------↓取IE缓存路径并加入路径列表
pathlist=WshShell.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache") & "\Content.IE5\;"&pathlist
pathlist=WshShell.RegRead("HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache") & "\Content.IE5\*\;"&pathlist
'------------------------------------------------------------------------↓取临时目录路径并加入路径列表
pathlist=WshShell.RegRead("HKEY_CURRENT_USER\Environment\Temp")&"\;"&pathlist
pathlist=WshShell.RegRead("HKEY_CURRENT_USER\Environment\Temp")&"\*\;"&pathlist
'------------------------------------------------------------------------↓分割路径列表
pathlists=Split(pathlist,";")
'------------------------------------------------------------------------↓分割开放运行的列表
filepaths=Split(filepath,";")

'------------------------------------------------------------------------↓循环路径列表
WshShell.RegDelete keypath

'------------------------------------------------------------------------↓开始写开放策略
For w = 1 to int(UBound(filepaths)) step 1
'------------------------------------------------------------------------↓置随机种子
    Randomize
'------------------------------------------------------------------------↓取6位随机数并转成16进制
    num6=Str2Hex(Int((899999 * Rnd) + 100000))
'------------------------------------------------------------------------↓写注册表项
    WshShell.RegWrite keyfile & "{8156dd45-e093-4a3e-9755-" & num6 & "}\",,"REG_SZ"
    WshShell.RegWrite keyfile & "{8156dd45-e093-4a3e-9755-" & num6 & "}\LastModified",0,"REG_BINARY"
    WshShell.RegWrite keyfile & "{8156dd45-e093-4a3e-9755-" & num6 & "}\Description","开放运行文件"&filepaths(w-1),"REG_SZ"
    WshShell.RegWrite keyfile & "{8156dd45-e093-4a3e-9755-" & num6 & "}\SaferFlags",0,"REG_DWORD"
    WshShell.RegWrite keyfile & "{8156dd45-e093-4a3e-9755-" & num6 & "}\ItemData",filepaths(w-1),"REG_EXPAND_SZ"
Next
'------------------------------------------------------------------------↓开放策略完毕



'------------------------------------------------------------------------↓开始写禁止策略
For o = 1 to int(UBound(pathlists)) step 1
'------------------------------------------------------------------------↓循环后缀名列表
  For p = 1 to int(UBound(namelist)) step 1
'------------------------------------------------------------------------↓置随机种子
    Randomize
'------------------------------------------------------------------------↓取6位随机数并转成16进制
    num6=Str2Hex(Int((899999 * Rnd) + 100000))
'------------------------------------------------------------------------↓写注册表项
    WshShell.RegWrite keypath & "{8156dd45-e093-4a3e-9755-" & num6 & "}\",,"REG_SZ"
    WshShell.RegWrite keypath & "{8156dd45-e093-4a3e-9755-" & num6 & "}\LastModified",0,"REG_BINARY"
    WshShell.RegWrite keypath & "{8156dd45-e093-4a3e-9755-" & num6 & "}\Description","禁止运行本路径中的"&namelist(p-1)&"文件","REG_SZ"
    WshShell.RegWrite keypath & "{8156dd45-e093-4a3e-9755-" & num6 & "}\SaferFlags",0,"REG_DWORD"
    WshShell.RegWrite keypath & "{8156dd45-e093-4a3e-9755-" & num6 & "}\ItemData",pathlists(o-1)&"*."&namelist(p-1),"REG_EXPAND_SZ"
  Next
Next
'------------------------------------------------------------------------↓结束指定进程
exitprocess("explorer.exe")
'------------------------------------------------------------------------↓更新组策略
WshShell.Run ("gpupdate /force"),0
'------------------------------------------------------------------------↓刷新桌面
WshShell.Run ("RunDll32.exe USER32.DLL,UpdatePerUserSystemParameters")
End Function

Function exitprocess(exename)'结束指定进程,可以是程序名或程序路径
     strComputer="."
     Set objWMIService = GetObject ("winmgmts:\\" & strComputer & "\root\cimv2")
     Set colItems = objWMIService.ExecQuery ("SELECT * FROM Win32_process")
     For Each objItem in colItems
         if objitem.ExecutablePath<>"" then '=========================先判断命令路径是否符合
            if instrs(objitem.ExecutablePath,exename) = False then '命令路径符合就结束
               objItem.Terminate()
            else
               if instrs(objitem.Name,exename) = False then '命令路径不符合时判断程序名
                  objItem.Terminate()
               end if
            end if
          else
             if instrs(objitem.Name,exename) = False then '命令路径为空时直接判断程序名是否符合
                objItem.Terminate()
             end if
          end if
      Next
End Function

Function instrs(patrn, strng) '搜索指定字符是否存在
  Dim regEx, retVal
  Set regEx = New RegExp
  regEx.Pattern = patrn
  regEx.IgnoreCase = True         ' 是否区分大小写。
  retVal = regEx.Test(strng)
  If retVal Then
    instrs = False
  Else
    instrs = True
  End If
End Function

Function Str2Hex(ByVal strHex) '返回16进制字符串
Dim sHex,tempnum
For i = 1 To Len(strHex)
  sHex = sHex & Hex(Asc(Mid(strHex,i,1)))
Next
  Str2Hex = sHex
End Function

使用方法以及注意事项:
把以上代码保存为xxx.vbs.运行这个vbs文件即可.
需要注意的事情,使用了这个脚本,会造成某些软件不能安装,主要就是(会在临时目录生成安装文件的)
解决方法..

On Error Resume Next
ungpedit()

Function ungpedit() '删除策略
On Error Resume Next
'------------------------------------------------------------------------↓禁止运行默认路径
keypath="SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths"
'------------------------------------------------------------------------↓开放运行默认路径
keyfile="SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\262144\Paths"
'------------------------------------------------------------------------↓删除注册表项
delreg(keypath)
delreg(keyfile)
Set WshShell = WScript.CreateObject("WScript.Shell")
'------------------------------------------------------------------------↓结束指定进程
exitprocess("explorer.exe")
'------------------------------------------------------------------------↓更新组策略
WshShell.Run ("gpupdate /force"),0
'------------------------------------------------------------------------↓刷新桌面
WshShell.Run ("RunDll32.exe USER32.DLL,UpdatePerUserSystemParameters")
End Function

Function exitprocess(exename)'结束指定进程,可以是程序名或程序路径
     strComputer="."
     Set objWMIService = GetObject ("winmgmts:\\" & strComputer & "\root\cimv2")
     Set colItems = objWMIService.ExecQuery ("SELECT * FROM Win32_process")
     For Each objItem in colItems
         if objitem.ExecutablePath<>"" then '=========================先判断命令路径是否符合
            if instrs(objitem.ExecutablePath,exename) = False then '命令路径符合就结束
               objItem.Terminate()
            else
               if instrs(objitem.Name,exename) = False then '命令路径不符合时判断程序名
                  objItem.Terminate()
               end if
            end if
          else
             if instrs(objitem.Name,exename) = False then '命令路径为空时直接判断程序名是否符合
                objItem.Terminate()
             end if
          end if
      Next
End Function

Function instrs(patrn, strng) '搜索指定字符是否存在
  Dim regEx, retVal
  Set regEx = New RegExp
  regEx.Pattern = patrn
  regEx.IgnoreCase = True         ' 是否区分大小写。
  retVal = regEx.Test(strng)
  If retVal Then
    instrs = False
  Else
    instrs = True
  End If
End Function

Function Str2Hex(ByVal strHex) '返回16进制字符串
Dim sHex,tempnum
For i = 1 To Len(strHex)
  sHex = sHex & Hex(Asc(Mid(strHex,i,1)))
Next
  Str2Hex = sHex
End Function

Function delreg(strkeypath) '删除注册表子项，只限为HKLM根路径。最后不能为"\"
  const HKEY_LOCAL_MACHINE = &H80000002
  strComputer = "."
  Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" &_
  strComputer & "\root\default:StdRegProv")
  oReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys
  For Each subkey In arrSubKeys
    oReg.DeleteKey HKEY_LOCAL_MACHINE, strKeyPath&"\"&subkey
  Next
End Function

保存为 取消保护.vbs ,碰到不能安装的软件运行这个之后安装就可。