Sometimes you need to deny specific application in Active Directory GPO.  There is a way, using