Preventing the execution of unauthorized Win32 applications

Describes an approach and tool for providing administrative control over the execution of software on a Windows NT/2000 system. The kernel-driver-based approach provides the system administrator with a way of restricting users to running only approved applications. As a result, illegal, pirated, personal and malicious software executables can be prevented from running on corporate machines. We describe the key issues involved in the development of this tool and the features that make this tool an important part of regaining enterprise-wide control over corporate machines.