Windows Process Blocker

The Windows application Process Blocker has been designed to provide system administrators and computer technicians with a security tool that can be easily distributed on a computer network to prevent unauthorized program starts. The program is currently in beta stage and has not completed the goal yet but it comes with a functional feature set that makes it interesting for many users.

Monitored Windows processes get killed at the moment after they are started instead of being blocked outright so that even a start is not possible anymore. A few small scripts can slip through at the moment because of this behavior as it takes some time to recognize a newly launched application and send the kill command to the computer system.

Process Blocker uses a simple text file that is placed in the same installation directory as the main application. This text file contains names of executables that are not allowed to be launched on a computer system. The program itself is added as a Windows Service to the system which has to be restarted after making changes to the text file.

Process Blocker will display a user notification in the Windows System Tray whenever a process has been blocked by the service. A similar application that provides a better user experience is the process manager Process Lasso. The developers of Process Blocker on the other hand are not even halfway through their roadmap. The next step will move the management of processes from the text file to a Group Policy administrative template. Other planned features are killing processes and applications using its crc (in case they get renamed) or full path, recording process errors and information in Windows Event log, allowing users to only run applications from specified folders (e.g. program files and Windows) and changing process killing to process execution prevention.

Related Articles:

Author: Martin Brinkmann, Wednesday March 18, 2009 -
Tags:block processes, monitor processes, network administration, process blocker, process lasso, process manager, windows network, windows process, windows security, windows services, windows software

Responses so far:

1. Taomyn says:

   March 18, 2009 at 5:48 pm

   Under Windows XP onwards, the same can be achieved using a local group policy (http://technet.microsoft.com/en-us/library/cc776536.aspx)

   No need for any 3rd party services

   Reply
2. MoonShiner says:

   July 6, 2009 at 11:27 am

   I am one of authors of Launch Control for Windows. There is a description of the program : www.launchctrl.com/technical.html. As you can see any program or library does not work until you allow or add it to rules of Launch Control. I used Process Blocker but I do not like that this tool scans processes list periodically and kills already runned processes. Some program can do not good things until it will be killed. Launch Control uses another technology.

   Reply