... Just don't allow users run stuff as administrator... If 0days are found by nsa they should report it and fix it, not exploited