How can I deny a Windows user account the ability to create new processes?
Update: The reason I want to do this is that I have a Windows Service that runs scripts in a multi-tenant system. I have the service running under the Local Service account but when user scripts run I use impersonation to switch the thread executing the script to a different less privileged account. The script execution account does not need to create any new processes so I'd like to stop it from doing so if possible.
