application control (how implement)

See more:

C++

Windows

application

, +

hello dears

our team want to implement an application control.
i have some question.
we have some white list that if an application was in thatlist can run in a system and other application should not run anywhere.

our goal is to prevent application to create process. for example createprocess is an windows api and we should prevent application that is not in white list to call this api.

what is the best way to prevent application to create process.

we have some idea:
1- write a driver in kernel mode.
2- write a service in kernel mode.
3- write a service in user mode.
if there is other solution, i will happy to know that solution.

other question:
antivirus like Kaspersky or ESET how implemented?
in kernel mode, have driver or write a service.

thank you very much.


[edit author="rjm"]
thank you for answering.
we want to protect system by an application not with windows Security Policy. by windows Security Policy user can disable that.
[/edit]