In tip 187 we learned how to prevent Last Known Good from being set and how to prevent a Last Known Good selection during boot.
Normally, Last Known Good is set when the first user logs on. If you set ReportBootOk to 0, you can run a boot verification service defined at:
HKEY_LOCAL_MACHINE\SYSTEM\all control sets\Services\BootVerify
or you can provide a program that sets ReportBootOk and define it at:
HKEY_LOCAL_MACHINE\SYSTEM\all control sets\Control\BootVerificationProgram\ImagePath
and enter the full path to your program in this type REG_SZ.
Check the SDK for details (don't ask us, we are not programmers).