Comand Prompt Restrictions

[Nemanja]

I have disabled the command prompt with the GPO, and also
put it as restricted aplication. I also did that for
command.com, but if user creates new shortcut for
command.com he can still run it with no problems. What I
can do?

 

[Dmitry Korolyov]

Unfortunately nothing. There is no easy way to prevent certain programs from
being run. You can accomplish this with expensive third-party apps which use
both hardware and software stuff to control literally everything happening
on your computer, SecureNet one of them.

 

[Dean Wells [MVP]]

Can the user actually do anything within the command prompt? This may
sound like an odd question but, IIRC, the shell will launch but will be
effectively useless.

Dean

 

[Brendon Rogers]

How about setting NTFS permissions on CMD.EXE and COMMAND.COM?

 

[Dmitry Korolyov]

Won't work - they are so easy to copy from somewhere else

 

[The Chad]

I had the same problem with this. Even after setting the
restriction in GPO, this only effects cmd.exe
Command.com still runs.

The only way to stop this is to use NTFS file
permissions. Set the security to deny for this
command.com.