MS-DOS /command prompt

[Davidp]

Hi,

I have a real issue at the moment.

I am IT admin for a school. We have just upgraded to Windows 2000 and XP
clients.

I have implemented group policies to lock down the desktop.including the XP
ADM files...But , and this is a major but....the students are somehow
getting access to the the command prompt and using this to do NET SEND
messenger attacks to certain people. This has now becoming a bullying issue.

Is there any way in group polocies i can stop the command prompt / disable
dos box so they cant use the NET SEND command.

In addtion can i, through group polocies, disable the messenger service on
the relevant PC's ?

Thanks in anticipation.

davidp

 

[Paul Banco]

You will need the XP admin files installed on the DC. You can just copy from
the windows\inf folder from the XP machine. The one in particular is the
system ADM. Once installed you can do the following below.

User Configuration, Administrative Templates, System

a.. Don't display welcome screen at logon (Enabled/Disabled)
b.. Century interpretation for Year 2000 (year)
c.. Code signing for device drivers (Warn/Ignore/Block)
d.. Custom user interface (file name)
e.. Disable the command prompt (Enabled/Disabled; plus Disable the command
prompt script processing also? (No/Yes))
f.. Disable registry editing tools (Enabled/Disabled)
g.. Run only allowed Windows applications (executable names)
h.. Don't run specified Windows applications (executable names)
i.. Disable Autoplay (CD-ROM drives/All drives)
j.. Download missing COM components (Enabled/Disabled)
For the service you can use
Computer Configuration, Windows Settings, Security Settings, System Services

a.. All services - Select service startup mode: Automatic/Manual/Disabled;
also Edit Security
This link will also show all teh Group Policies that can be applied and
where yhet can be applied.

https://lspservices.iupui.edu/docs/win2k/gpo_configurations.asp
Hope this helps

Paul