The only way to make that work would be to have a signature for all
programs users are allowed to execute, that way even if the user changes
that name of the the program he/she wants to execute the signature still
wouldn't match. I'm not sure that this can be setup without using third
party soft...

[ more ]