Preventing the execution of unauthorized Win32 applications

Abstract

This paper describes an approach and tool for providing administrative control over the execution of sofhyare on a Windows NTD000 system. The kerneldriver-based approach provides the system administrator with a way of restricting users to running only approved applications. As a result, illegal, pirated, personal, and malicious software executables can be prevented from running on corporate machines. We describe the key issues involved in the development of this tool and the features that make this tool an important part of regaining enterprise-wide control over corporate machines.

Hardening Windows Systems

“…Through the use of a kernel driver, all new process creation is controlled. (Schmid et al, 2001) Microsoft added a technology called group policy to its Active Directory environments. An administrator can control which executables are able to run on a computer through a software restriction policy.…”

A Lightweight Binary Authentication System for Windows

“…The closest work on binary authentication in Windows is the Emu system in by Schmid et al [13]. They intercept process creation by intercepting the NtCreateProcess system call.…”