What are known/documented/undocmented methods of the process start monitoring?

Question

I need to monitor and, if it is needed, decline process start in the Windows XP and Vista OS? What are known/documented/undocmented methods? What about known hacks of this methods?

(It will be used for the shareware firewall/security software).

Answer 1

For monitoring you can use WMI events.

There is no^[1] method to decide whether to allow the start or not. If you are on Pro/Biz/Ent/Ultimate editions group policy can be used to block specified executables from being launched, or limit to a specified list.

^[1] As far as I am aware.

Answer 2

Be very careful with any code that thinks it knows enough about what a user is doing to know whether or not to allow a process to start. It's a great way to find out how much you don't know about your users, but only if you provide an email address for the users to send complaints to.

An example was some VPN software I worked with that hooked into the Windows system to be notified whenever a DLL was loaded. It actually caused BSOD when running a very common application - Visual Studio. The manufacturer wasn't aware of how modular VS is, and that starting it loads many DLLs, and sometimes even more during execution, as new features are loaded.

When you put yourself in the position to do things for your users, you have the responsibility to know enough to do them correctly.