How to intercept and possibly block process creation, system-wide?

I’m trying to make an AppLocker-like service that should intercept creation of processes based on certain restrictions set by an administrator.

(For those who are wondering why I can’t simply use Microsoft’s AppLocker, the answer is that it is available only on the Server, Enterprise and Ultimate versions of Windows 7 and up.)

So I did some research and found the CreateProcessNotifyEx routine that can be called before each process is started/ended.

I don’t have a big experience writing Windows Kernel drivers. And thus I’m curious if this is the correct approach to do what I described above? Or maybe there’s just a user-mode WinAPI that I’m not aware of?

You need to sign in to view this answers