Q. How can I stop users from installing Windows XP Mode on Windows 7 machines?

A. I was amazed how many people sent me this question, for several reasons.

Before you worry about how to stop users from installing XP Mode, it's important to understand why they want it. If they have a business need for an application that doesn't run on Windows 7, just stopping them will stop them from doing their jobs (and likely get you in big trouble). If they have a need, address that need in a controlled way, such as using MED-V to manage a corporate Windows XP image or running the legacy application on a Windows Server 2003 Terminal Server.

The easy way to stop users from installing XP Mode is to not make them local administrators, which really should be your goal with Windows 7 deployments. There are very few instances where users need to be local administrators.

If you make users local administrators and still want to stop them from using XP Mode, you need to understand the general rule that if they're local administrators, you really can't stop them from doing what they want on a box—they can work around policies or other methods, so don't expect any block to be unbeatable.

That being said, to stop for the majority of users, I'd use AppLocker or Software Restriction Policies and block the Windows Virtual PC executables. The main executable you want to block is vpc.exe, but there's a full list in this Microsoft blog entry.