Bdtyktl

I want to block any program at a specific full-path name from being executed.

For example, if D:foo.exe is in the blacklist, any program renamed and moved to that path will not run. If renamed or moved to something or somewhere else, then the program may run if other conditions allow (ACL, etc.).

Is there a solution that will work across all versions starting from Vista (NT 6.0)? Additionally, is there any solution specific to Windows 10? If so, what is the "minimum required" version (e.g. v1507)?

You will need to write your own anti-exec program.

There are various articles to be found on hooking process creation in the kernel,
but they all require installing a driver, which is not very portable and will
encounter driver signature problems on later Windows versions.

The simplest solution would be to write a small DLL to be injected into all
processes, which will, in the context of the process, get its path and
terminate it immediately if coming from this path.

Injecting the DLL is done using regedit and navigating to
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWindowsAppInit_DLLs.
On later versions of Windows, AppInit_DLLs is disabled when Secure Boot is enabled.

See the Microsoft article
Working with the AppInit_DLLs registry value.

A skeleton for such a DLL may look like:

BOOL

WINAPI

DllMain ( HINSTANCE hInst, DWORD dwReason, LPVOID) {

  TCHAR acModule[MAX_PATH];

  switch (dwReason) {

    case DLL_PROCESS_ATTACH:

      GetModuleFileName(NULL,acModule,MAX_PATH);

      to_be_written(acModule);

      break;

    default:

      break;

  }

  return TRUE;

}