This policy setting allows you to specify whether unsigned applications are allowed to run on Windows Mobile powered devices. ...

This policy setting allows you to specify whether unsigned applications are allowed to run on Windows Mobile powered devices.  If you enable this policy, then only signed applications, and unsigned applications that are given specific permissions, are allowed to run on the device.  If you disable this policy, then all unsigned applications are allowed to run on the device. Depending on the existing device-specific policies, the user may be prompted for consent before an unsigned application is allowed to run.  If you do not configure this policy, then existing device-specific policies that control whether unsigned applications are allowed to run on the device are applied.