CF10 enterprise - how to disable cfexecute for all sites (sandbox)

Hello,

I have a new CF10 server which I will be using as shared hosting for my clients.

I would like to disable the following tags and functions globally:

TAGS
CFCONTENT
CFFILE
CFDIRECTORY
CFEXECUTE
CFOBJECT
CFREGISTRY

FUNCTIONS
GetProfileString
SetProfileString
CreateObject

I know in CF10 Standard I can block these for all sites using 'resource security', this will stop these tags from running at all.

In CF10 Enterprise I have the option to create multiple sandboxes, but is it possible to create one global sandbox for all sites?

My directory structure looks like:

D:\sites\site1

D:\sites\site2

D:\sites\site3

Can I create a sandbox disabling the above tags and functions just for D:\sites and all subfolders?

I have tried but it does not seem to work - I have a sandbox setup for D:\sites with the above tags and functions disabled, but using a test script I can still use cfexecute in site1 to execute netstat.

I do not wish to create a sandbox for each site as when new sites are added I would need to manually add a sandbox each time.

If anyone has any ideas it would be most appreciated.

Cheers

Luke