A method and apparatus for controlling the distribution of computer software products stored at a file server provide for requesting the identity of the user and the user's secret key prior to enabling access to a requested program product. The program product, upon proper verification of the user identify, is encoded using a second key which is known to the user, and preferably an identification of the user is embedded in the encoding program. Various methods are employed for tracking user access to particular programs, including storing the identify of the user either camouflaged in a commonly found program in non-volatile memory or hidden in a typically overlooked portion of non-volatile memory. In addition, the encoded program can have embedded therein one, and preferably two identifications of the user which can be used to track the program as well as to ensure that the program, when executed has not been tampered with. Upon execution of the encoded program by the user's system, the code is executed "on the fly" and no executable copy of the code is stored in non-volatile memory at any time. In the event that decoding does not result in a properly executable program, the system may need to be rebooted and/or the program may be at least partially destroyed.