You can disable the WOW (Windows On Windows) subsystem or both the WOW and NTVDM (Windows NT Virtual DOS Machine) subsystems AND generate a message that identifies the 16-bit program that attempted to start.
NOTE: If you use logon scripts, change the file extension from .BAT to .CMD, to allow them to run without starting the NTVDM.
Use Regedt32 to navigate to:
To disable only the WOW subsystem, double click WOWCMDLINE in the right hand pane and add a _ (any character) to the beginning of the string. This will make it easier to revert to the origonal setting.
To disable the NTVDM subsystem also, double click CMDLINE in the right hand pane and add a _ to the beginning of the string.
NOTE: These changes are dynamic, so you do NOT need to restart.
Here is an example of the message displayed:
Windows cannot find edit.com
This program is needed for opening files of type "MS-DOS application"
Cannot find d:\WTSRV\system32\sysedit32.exe. Windows needs this file to run d:\WTSRV\system32\sysedit32.exe.