function Register-ProcessStartKill {
    [CmdletBinding(SupportsShouldProcess=$true)] param(
        [switch]$unregister
    )
    if ((Get-EventSubscriber -SourceIdentifier 'ProcessStarted' -ErrorAction SilentlyContinue) -ne $null) {
        Write-Verbose "Unregistering existing 'ProcessStarted'"
	    Unregister-Event -SourceIdentifier 'ProcessStarted'
        # Alternate method:
        # Get-WMIObject -Namespace root\Subscription -Class __EventFilter -filter "Query like '%Win32_Process%'" | % { $_.delete() }}
        if ($unregister) {
            Write-Verbose "Event subscriber 'ProcessStarted' was removed on $($env:COMPUTERNAME)"
            return;
        }
    } else {
        if ($unregister) {
            Write-Verbose "Event subscriber 'ProcessStarted' was not found on $($env:COMPUTERNAME)"
            return;
        }
    }
    Write-Verbose "Creating Windows Event Log source 'ProcessStarted'"
    New-EventLog –LogName Application –Source 'ProcessStarted' -ErrorAction Ignore

    $query = 'Select * From __InstanceCreationEvent Within 2 Where TargetInstance Isa "Win32_Process"'
    Write-Verbose "Creating WMI event subscriber with query $query on $($env:COMPUTERNAME)"
    Register-WMIEvent -Query $query -SourceIdentifier 'ProcessStarted' -MessageData $json -Action {
        $logFile = Join-Path (mkdir c:\\temp -force) 'ProcessStarts.log'
	    try {
		    $instance = $EventArgs.NewEvent.TargetInstance
		    if ($instance.CommandLine -match '^["]*[A-Z]:\\Users\\' -and $instance.CommandLine -notmatch '(windiff.exe|oleview.exe)[",\ ]{0,2}$') {
			    Stop-Process -Id $instance.ProcessId -ErrorAction Stop -Force
			    $action = "Stopping"
                $message = "ProcessStarted v1.0.1 $action $($instance.CommandLine) $($instance.ProcessId)"
                Write-EventLog –LogName Application –Source 'ProcessStarted' –EntryType Warning –EventID 1  –Message $message -ErrorAction Stop
		    } else {
			    $action = "Permitting"
		    }
		    "$action $($instance.CommandLine) $($instance.ProcessId)" | Out-File $logFile -Append
	    } catch {
		    $_ | Out-String | Out-File $logFile -Append
	    }
    }
    Write-Verbose "Event subscriber $(Get-EventSubscriber -SourceIdentifier 'ProcessStarted' -ErrorAction SilentlyContinue | select -ExpandProperty SourceIdentifier) was created on $($env:COMPUTERNAME)"
}

<#
None of this works due to some mystery with Register-WMIEvent remote execution - it creates a job that wont start!
function Register-RemoteProcessStartKill {
    [CmdletBinding(SupportsShouldProcess=$true)] param(
        $ComputerName = $env:COMPUTERNAME,
        [switch]$unregister
    )
    $ComputerName = [Net.Dns]::GetHostEntry($ComputerName).HostName
    $unregister2 = (test-path variable:\unregister) -and $unregister
    $sb = [ScriptBlock]::Create('param($params);function Register-ProcessStartKill {' + (get-item Function:\Register-ProcessStartKill).definition + '};Register-ProcessStartKill @Params')
    invoke-command -ComputerName $ComputerName -ScriptBlock $sb -ArgumentList $PSBoundParameters -UseSSL -EnableNetworkAccess -Verbose
}
<#
(get-item Function:\Register-ProcessStartKill).scriptblock.invoke($true)
(get-item Function:\Register-ProcessStartKill).scriptblock.invoke()
#>
<#
get-eventsubscriber
Register-RemoteProcessStartKill -verbose
get-eventsubscriber
#>
<#
Register-RemoteProcessStartKill -unregister -verbose
get-eventsubscriber
#>