Need help with GPO to block .exe's in %appdata% folder

I am new to using GPO and need help in setting up a policy to block .exe's from running in the %appdata% folder. I am doing this to deny certain malware from being able to run most notably the crypto-locker malware.

My server is running 2008 R2

Thanks for your help

Paul