How to block programs from running (Windows 7)

Question

I'm need to find an easy way to let a few end users block certain programs from running. to be a bit more specific;

At my school we have a couple of laptops (~15) that we use to make assessments, sometimes the users may not use Word, Excel, Calc, internet etc. After each test is made, we need to image the laptop again so no traces are being left. Of course we can add them to a GPO but then the IT service must every time check which programs mustn't be used and apply this rule to every laptop one-by-one (because there always different assessments at the same time).

So what i thought, was to just make a USB with .reg files where in I specified to block for example word, and name it "block word" so that the teacher who setup the assessment only have to click to block the programs.

But now my problem: I'm more of a Linux guy, actually i never made a .reg file so i search the net, but can't get it to work. Maybe can someone give me a template that I just need to fill in the path's ? Or is there an other way to do this easy (some tool) ?

thnx in advance

Answer 1

Solution

Here's a template you can use:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\whatever.exe]
"Debugger"="systray.exe"

To revert back you just need to remove the registry key:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\whatever.exe]

Note Administrator rights (or enough rights to access the related registry key) are required in order to apply the changes.

How it works

The Image File Execution Options registry key was designed, among other things, to automatically launch a debugger when an application starts. While the debugger would start the application and attach, you can specify just any executable which will be run instead, thus overriding the original one.

What about systray.exe? It's a little stub program which was first introduced with Windows 95, and used to handle the system notification icons. It's not really used any more in the newer Windows versions, and it was mostly kept for backward compatibility reasons. It has no user interface, and doesn't do anything noticeable besides refreshing the notification area when started.

Remarks

• Changes are applied immediately, and work regardless of the Windows 7 edition installed.

• If you want to display a standard error message instead, replace systray.exe with %1 (any non-existing executable will do as well). Displaying a custom message would require creating either a custom program or script, and launch that.

Known limitations

• Since the method is based on the program name, one could workaround it by renaming the executable to something. That can easily be avoided by making sure users the program is located in a directory which they don't have full control of (e.g. C:\Progam Files).

• One could copy the whole program folder elsewhere (e.g. on the desktop) and then rename the executable. Some programs might not run that way, but others could. To avoid this, make sure users have no write permissions in their profile folders unless otherwise required.

References

• How to add, modify, or delete registry subkeys and values by using a .reg file
• How to turn off the Windows Update feature in Windows XP

Answer 2

If your Windows computers are in an Active Directory environment, you can use Software Restriction Policies to prevent programs (except your whitlisted ones) from running.

You cannot block "programs" from accessing the registry, but you can deny users access to it. Beware, though, that programs run under the context of the user and may need access to various parts of the registry.

I don't understand why you have different policies applied one by one to each laptop. Do you have laptops which are supposed to run Word but not uTorrent, and others which are supposed to run uTorrent but never Excel?