Abstract: A method for protecting one or more computer systems from unwanted software. A protection server computer maintains an approved list identifying a plurality of process files approved for execution. The protection server distributes an agent software program and the approved list to each of a plurality of computer systems. When a first computer system receives a request to execute a first process file, the agent software program intercepts the request and ensures that the first process file is on the approved list. The agent may also check a forbidden list of known bad software to ensure that undesired software is not executed. The approved list may be created by first configuring a securely managed “golden machine” with software (process files) intended to be used by computer systems in the enterprise. The approved list may then be created based on the known good process files stored on the golden machine.