block students from using command prompt

[beancole]

Hi All,

 

I am looking for a way to stop students from using command prompt. I can block command prompt all together by GPO User Configuration\Administrative Templates\System but a technet article says not to do this if you are using logon, logoff, startup, or shutdown batch file scripts. (http://technet.microsoft.com/en-us/library/cc975912.aspx)

 

This is a setting that has always been set in the schools I have worked in so never had to configure this myself.

[AlexB]

News to me. We have "Prevent access to the command prompt" set and scripts run at login/logoff

 

If you really want fun. save this is a .hta and .htm file (open the later in IE) and then work out how to block it

 

	Bubbles
	<br />
			var a = new ActiveXObject( "WScript.Shell" );<br />
			a.run( "command.com" );<br />
		
	<br />
			<br />
		


	

[synaesthesia]

Ditto, everything runs just fine including a few cmd based scripts at logon.

[Norphy]

Hi All,

 

I am looking for a way to stop students from using command prompt. I can block command prompt all together by GPO User Configuration\Administrative Templates\System but a technet article says not to do this if you are using logon, logoff, startup, or shutdown batch file scripts. (http://technet.microsoft.com/en-us/library/cc975912.aspx)

 

This is a setting that has always been set in the schools I have worked in so never had to configure this myself.

 

By the looks of it, that article relates to Windows 2000. As others have said, you should be able to run login/out scripts and disable the command prompt with newer versions of Windows if you so desire.

 

Whether it's worth the effort or not is another question.

[dwhyte85]

change comspec variable, that'll make it a bit more difficult maybe.

[Ephelyon]

You can set that setting just fine, just don't set disable script processing to Yes as well if you still want to run logon scripts and etc.

[cobra427col]

This reminds me of last week (sort of related so hang in there)

 

Went to pay the council tax - but there was only one window open and a big queue. So went and sat a at bank of machines to "play" until the line shortened.

First off I kicked the Dell as I sat down (they were sat on the floor) - then managed to get the browser to leave the council's site. then thought "oooh could do with a calculator"

Start programs - acces... oh no accessories.

never mind - typed cmd (thinking that'll never work) hit return

up it came ..... "Hmmm what else can I do"

 

after 20-25 mins of "playing" I suddenly thought about the parking meter and left.

 

I wont bother telling the council - I enjoyed my bit of fun too much

[Michael]

I still configure this policy today (even on modern 2008 R2 / 7 networks) and it works exactly as it did since Windows 2000.

 

Even if someone cleverly creates a shortcut to cmd.exe, it'll just inform them it's been disabled by their administrator.

 

Set the policy 'Prevent access to the command prompt', to Enabled, then select No from the drop down menu and that's it. The only time I deploy using scripts these days is the wireless key, using the netsh wlan command.

[sted]

I still configure this policy today (even on modern 2008 R2 / 7 networks) and it works exactly as it did since Windows 2000.

 

Even if someone cleverly creates a shortcut to cmd.exe, it'll just inform them it's been disabled by their administrator.

 

Set the policy 'Prevent access to the command prompt', to Enabled, then select No from the drop down menu and that's it. The only time I deploy using scripts these days is the wireless key, using the netsh wlan command.

 

does that block powershell as well?

[Michael]

does that block powershell as well?

 

No as Powershell is powershell.exe rather than cmd.exe. You could create a GPO to block it, or rename it in: C:\Windows\System32\WindowsPowerShell\v1.0 for example.