Check out software restriction policy settings if you want to really lock it down. That's why I always keep my additional servers in a separate OU.