is there a registry setting that one can enable to prevend programs from creating exceptions for themselves in this s/w firewall?

i don't get it. what kind of firewall protection is this that can allow 3rd party apps to create exceptions for themselves?

notes:
- we are not running AD.
- we don't want to use another vendors s/w firewall on the XP clients. (actually, it's not my decision. orders from up above. i just follow.)