PolicyPak can already control how child processes are handled. You can turn them on and off and open up some extra locations if needed. But you might also want to control the File/Open or File/Save dialog as something specific to tighten and ensure child processes cannot be launched from there. (Required MMC and CSE and build 3000 or later.)