limiting administrative tools on workstations to prevent ransomware

What are some administrative tools AND applications that should be limited on every device? For example, we need PowerShell on computers for troubleshooting so we can't disable that. However, we never use psexec and it can be used maliciously so we can blacklist that application.

​

What are some other tools or programs we should 100% blacklist on each computer that won't interfere with day to day troubleshooting/system admin work?

cybersecurity ransomware tools workstations