A method (300) and system for controlling use of software programs on multiple workstations of a network. An agent running on each workstation detects (306) any new process (using a kernel hooking technique), which is started in response to the request of execution of a program (397). The process is suspended (308) and an authorization to run the program is requested (334) to an associated metering server. The metering server compares (380) the current usage of the product with the respective authorized conditions of use, and answers (382) the agent granting or denying the authorization to run. The process is accordingly resumed (312), in order to enable the program to start, or aborted (315), so as to prevent execution of the program. In any case, the program is not stopped (but it is prevented from starting); this avoids killing the program while it is performing potentially risky operations.