How can I stop users from running executables from a cd rom drive but still allow users read access to all other file types