Block users running a batch file to run command.com?

[reggiep]

Forgive me if I sound ignorant here but I have just moved from CC3 to a vanilla Windows 2008 environment.
One thing that a friendly work experience guy has pointed out is that if he creates a batch file with command.com inside it he can run it and then have the command prompt.
Is file screening the way to go with this or is there a better solution?
I have read that with file screening the users could just rename the extension and then use it whenever!

[CyberNerd]

deny users access to command.com by setting the ntfs permissions

[maniac]

Software restriction policies is the way forward here, you can deny access to specific programs by using a hash of them (so even if they renamed it it still wouldn't run) as well as stopping batch files being run from their home areas by denying executables on anything except the C:\

There is also a GPO 'deny access to command prompt' which if set should stop it being run as well.

Mike.

[reggiep]

Cheers Guys, I'll take a look on Monday.