Yep. To add insult to injury, for many years there either wasn’t a setting to disable loading of external programs or doing so required a subscription of some kind to a MS enterprise license/endpoint/policy management feature.