... launching unless you OK it.
Additionally, it is possible to specify that certain executables (typically browsers and email clients) are run with reduced rights. This is a valuable damage-limitation measure against browser plugin vulns, etc.
The protection can be turned off without a reboot whilst installing legitimate software, and will automatically reactivate after a specified time