Software Restrictions Policies

By Paul Qureshi

You can tell Windows not to allow certain software to run.
You can block an individual program, or any program inside a directory
you specify.

For example, you can prevent programs in your downloads folder from
starting, preventing accidental double-clicks before you have a chance
to do a virus scan. Even if you have anti-virus software running,
nothing catches every virus so it's worth uploading files to Virus Total
(web site that runs 20 different anti-virus programs on the file).

You can also use it to prevent annoying programs, like the "buy me now!"
screen in the free version of AntiVir.

To set it up, go to the start menu and select -

"Run..." In the box, enter "gpedit.msc".

You get a new window, now navigate to -

"Computer Configuration -> Windows Settings -> Security Settings -> Software
Configuration -> Restriction Policies".

On the right it will say "No
software restriction policies defined", simply right click and select
"New software restriction policies" to set them up.

You now get a sub-folder called "Additional Rules".

Enter it and right click to add a new rule.

The two main ones are "Hash rule" and "Path
rule". Hash rules block a specific program file, no matter where it is.
Path rules block either a specific file or directory, but if you then
move that file/directory (say from your downloads folder to another
folder) it can be run.

With path rules, you can use wildcards, so for example I have
"d:\downloads*" where the * blocks everything in that directory.

http://world3.net