Group policy (-y, not -e) can block based on filename, or checksum, or allow running only "certified" (signed) programs.

Aaah ... yes, I wondered whether there might be something like this at play.
It's something that's well and truly outside of my experience.
Thanks for the info.

Cheers,
Rob