Prevent Student Access To Command Prompt

Removed.

Stop students from accessing word? :)

Not sure on a vanilla network, but anyone running ranger can do a title bar search on this, as I believe command prompt will still run with 'C:\windows\command.com' in the title bar, so program this in and as soon as ranger sees that in the title bar of a program it will close it.

Can't think of an immediate way with active directory, but I'm sure there is.

Mike.

Wont the setting in the GPO do it,
User Configuration > Administrative templates > Sytem > Prevent access to the command prompt.

Or User Configuration > Administrative templates > Sytem > Dont run specified windows applications?

Jack

Quote:

---

Not sure on a vanilla network, but anyone running ranger can do a title bar search on this, as I believe command prompt will still run with 'C:\windows\command.com' in the title bar, so program this in and as soon as ranger sees that in the title bar of a program it will close it.

---

Stick the following in the nearest windows run box:

Code:

---

cmd /c start "wibble.exe" cmd

---

Have you tried setting up software restriction policies in a GPO to block this? You may have difficulties if your login scripts run as a batch file although I'm guessing they don't.

Quote:

---

Originally Posted by Geoff

Stick the following in the nearest windows run box:

Code:

---

cmd /c start "wibble.exe" cmd

---

---

Ah but Ranger should stomp on the window of the original command window before it launches the second one.

Also the wibble command window stills shows executed commands in the titlebar.

Quote:

---

Originally Posted by DaveP

with properties that students cannot access them, but System can. I suppose that is why it works [Because the System is making the call to cmd.exe from inside Word, not the Student, if that makes sense] I dont think that I can deny access to System, so how do I prevent student doing this before it becomes a rash all over my network?

---

This can't be true or one of your students has just discovered a very serious security vulnerability in Microsoft Office.
System is the Windows equivalent of the root user in Unix. If someone one can get to run a command shell in the System context they own the box, game over, end of story.

The only protection might be to disbale unisgned macros from running in Word. Alternatively you can use a disk protection product like Deep Freeze or Microsoft's Shared compuer toolkit.

Removed.

Quote:

---

Originally Posted by Jackd

Wont the setting in the GPO do it,
User Configuration > Administrative templates > Sytem > Prevent access to the command prompt.

Or User Configuration > Administrative templates > Sytem > Dont run specified windows applications?

Jack

---

Hi Jack,

Both restrctions already in place. :(

:oops:

Removed.

:oops:

Report it to Viglen....

it's a flaw in Classlink and they should be dealing with it, you have paid all that money after all!