1000+ machines and no way to update a file with a few commands/clicks/whatever-your-configuration-management-system-uses? (Ok, at worst, making a batch file and scheduling its launch.)

If so, I suppose you have big issues with your system administration team.

Yes they're factory pressed Windows administrators who are to be honest fucking useless unless it comes to pointing at someone else but that's another story...they're being replaced piecemeal by bits of Ansible and Linux machines.

Realistically we don't want to deploy a host file and AFAIK it doesn't work anyway; we want to control the network itself which we do via firewalls and DNS but it's a compromise between flexibility (our users still need to use the internet) and security.

If they're using DNS to resolve the name of the "mothership" just put a bogus record (or zone) in your DNS. If they're not using any name resolution protocol and you can isolate the IP addresses they're talking to just blackhole them at your border.

We're already doing that but it's hard work keeping up with it all.

And then Microsoft will fix that, ...

Default deny is the only viable strategy. (It's also completely impractical...)

> somewhat

Yes I can see how that would complicate things a little :)