Herb Martin wrote in
Over on the AD Newsgroup someone (Rhinehart?)
post this for disabling exe's with GPOs:
##Open the GPO you need to edit then navigate to :
##User Configuration>>Administrative Templates>>System
## >>Don't run specified windows applications
## just need the name of the .exe to restrict.
Now, that doesn't sound so hard -- at least not as difficult
as I made it seem.
But may not be as effective as you think.
"This policy only prevents users from running programs that are
started by the Windows Explorer process. It does not prevent users
from running programs, such as Task Manager, that are started by the
system process or by other processes. Also, if you permit users to
gain access to the command prompt, Cmd.exe, this policy does not
prevent them from starting programs in the command window that they
are not permitted to start by using Windows Explorer."
It depends on how locked-down the system is and how savvy are the
users. For example (notepad.exe locked out) if you can copy
notepad.exe to notepad.com that can be started even via a shortcut
(Explorer shell). And of course from a command prompt as above.