AppLocker Policy to block Malware

Question

I am in process of implementing Applocker in our Environment.
To protect the clients from Malware attacks I want to configure a policy through which all the executable files can not run from User Profile. However I may have few executable files which must run as exception to this rule from the user profile.
Please help me in creating this Policy.

Answer 1

Why use a standard user account instead of an administrator account?http://windows.microsoft.com/en-us/windows/why-standard-user-account#1TC=windows-7
Most of the malware is designed to run under at least power user or admin account..
"Power Users The Power Users group primarily provides backward compatibility for running non-certified applications. The default permissions that are allotted to this group allow this group's members to modify computer wide settings.
If non-certified applications must be supported, then end users will need to be part of the Power Users group."
You can prevent most of the virus and other things using antivirus + firewall/internet security along with standard user give the least privileged... 
For example think about rogue antivirus.. http://www.microsoft.com/security/pc-security/antivirus-rogue.aspx
Microsoft recommends the following.
Install a firewall and keep it turned on.
Use automatic updating to
keep your operating system and software up to date.
Install antivirus and antispyware software and keep it updated. Windows
8 includes antivirus protection that’s turned on by default. If your computer isn’t running Windows 8, download Microsoft
Security Essentials for free.
Use caution when you click links in email or on social networking websites.
Use a standard
user account instead of an administrator account.