Disabling completely DOS programs

[Solomon]

How to disable completely all DOS programs/windows use?
I want to inactive CMD.EXE, COMMAND.COM, MSDOS.PIF, ...

What I did:
1. Add these programs to local and domain policies: "Don't run specified
Windows applications" and "Restrict these
programs from being launched from Help" and enable "Prevent access to the
command prompt".
2. Change security permissions to above programs.

But some users rename these programs and later execute them with other
names.

Do you know some effetive way to prevent completely DOS programs?

THANKS!

 

[Clark Griswold]

How to disable completely all DOS programs/windows use?
I want to inactive CMD.EXE, COMMAND.COM, MSDOS.PIF, ...

What I did:
1. Add these programs to local and domain policies: "Don't run specified
Windows applications" and "Restrict these
programs from being launched from Help" and enable "Prevent access to the
command prompt".
2. Change security permissions to above programs.

But some users rename these programs and later execute them with other
names.

Do you know some effetive way to prevent completely DOS programs?

THANKS!

Why don't you try moving them out of harms way?

 

[Solomon]

FYI: Issue resolved.

1. Adding dword register key named disablecmd at
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system where
0 = Not Configured
1 = Disable CMD and BAT scripts
2 = Disable CMD but not BAT scripts
2. Changing NTVDM.EXE (windows\system32\) permissions. This file allows
compatibility with 16 bits applications (command.com, msdos.pif, ...)