How to restrict CMD.EXE and taskmgr.exe through GPO in windows 200

[Guest]

How to restrict CMD.EXE and taskmgr.exe through GPO in windows 2000

 

[Jerold Schulman]

How to restrict CMD.EXE and taskmgr.exe through GPO in windows 2000

USER Configuration Administrative Templates\System Run only allowed Windows applications At least Microsoft Windows 2000 Limits the Windows programs that users have permission to run on the computer. If you enable this setting,
users can only run programs that you add to the List of Allowed Applications. This setting only prevents users from running programs that are started by the Windows Explorer process. It does not prevent users from running programs such as
Task Manager, which are started by the system process or by other processes. Also, if users have access to the command prompt, Cmd.exe, this setting does not prevent them from starting programs in the command window that they are not
permitted to start by using Windows Explorer. Note: It is a requirement for third-party applications with Windows 2000 or later certification to adhere to this setting. Note: To create a list of allowed applications, click Show, click Add,
and then enter the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe). HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer!RestrictRun,
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun!{1,2,3,...}

 

[Reinhardt Kern]

USER Configuration Administrative Templates\System Run only allowed Windows applications

Hi Virendra,
be aware, that this limitation is just a name checking. If
"Winword.exe" is an allowed application, I will rename CMD.EXE
into Winword.exe and can execute it now.

Another way of restriction is to modify the security settings, so
only administrators are allowed to execute CMD.EXE and
TASKMGR.EXE - But this cannot be done by GPO.

Aware: If you disallow CMD.EXE, the users cannot execute batch
files! You have to use VBScript instead.

best wishes,
Reinhardt

 

[Marty List]

1. User Configuration -> Administrative Templates -> System -> Prevent
access to the command prompt

2. User Configuration -> Administrative Templates -> System -> Ctrl+Alt+Del
Options -> Remove Task Manager


Microsoft Shared Computer Toolkit for Windows XP (Beta)
http://www.microsoft.com/downloads/...56-e3da-42ea-857d-92b716077a84&displaylang=en