ways to deny an .exe from being put on network at school by students

I am having problems with students downloading a keylogger program and using it to access passwords of teachers, administrators, servers, and filter. I want to know how to stop this without a lot of expense added to the district. But, I want to have have the ability to download the .exe when as an Administrator I need to download something.