Checkpoint VPN-1 SecureClient for Windows
 

Anyone know how to prevent this preloading for all users on a machine?

Probably an option at install time. Otherwise manually move start menu items out of 'All Users' or 'Default User' into the profile you want it to run on. Note that this wont stop other users loading the software, but does mean they'll need to go and find the executeable by themselves :)

Haven't used Fw1 for a few years, but the client then installed a network service bound to the card. I suppose the easiest way is to deny permission to the actual client exe to normal users?