Here are some more techniques which may help you:
[ol]- You can set a rule that says CIS must sandbox all unrecognised files. To do this you need to use the registry hack supplied by Egemen in the 6.0 Beta announcement topic here.
- You can run a program sandboxed from the command line for example using virtkiosk - . The switches appear to be:
-v “app” runs app virtualised not in kiosk
-r runs a new instance of the default browser in existing kiosk instance
-d is really wierd. It runs the browser in a new kiosk instance. But if you have one instance already running you get a hybrid between Kiosk and your normal desktop. Useful but unstable. Try it in a virtual machine for safety - You can copy Virtkiosk.exe to a new file name, then sandbox it using Advanced settings ~ D+ ~ Sandbox ~ Add at any desired restriction level. Note that this may not be intended functionality and so may be unstable. Try it in a virtual machine first.
- In Shared Space, you can run a file that does not require elevated privs sandboxed just by double clicking on it. Or a file that does require elevated privs by double clicking on it and choose to sandbox it from the Elevated Privs alert.[/ol]