Group policy (-y, not -e) can block based on filename, or checksum, or allow running only "certified" (signed) programs. That depends on how the domain is configured. chafelix would have to ask their administrators about "Software Restriction Policies", or use an exempt computer for this.

An alternative might be to have gmake.exe signed (by someone recognized by chafelix's organization) or explicitly allowed.