JSI Tip 1724. How do I prevent any 16-bit application from running?

To prevent a 16-bit application from running, deny access to %SystemRoot%\System32\ntvdm.exe for the selected users.

Examples:

To prevent members of the local Sales Persons group from running 16-bit applications, type:

CACLS %SystemRoot%\System32\ntvdm.exe /E /D "Sales Persons"

To prevent Everyone from running 16-bit applications, type:

CACLS %SystemRoot%\System32\ntvdm.exe /E /D Everyone

See tip 1556.