OK, I need to take a page from Indy's book and be careful with the multi-tasking.
I almost posted all the steps needed to lock a Windows 2016 domain down with Software Restriction Policies in this thread. Not only wrong thread but also entirely wrong forum.
JamesNT