Windows 10 Start Menu Search can run commands

[JoeCav]

I'm wondering if anyone else has managed to find a solution to this problem yet. In the Windows 10 start menu search you can enter anything, so for example:gpupdateservices.mscpowershellAnd it allows it to run the command. I have used all of the GPO's which seem like they would limit searching down but maybe someone knows of a registry fix or something else that can block the search box from running anything that isn't a Program File.Thanks

[eddyc]

Hey.

 

Did you find a solution to this? I'm almost ready to go with windows 10 and am having the same issue.

 

I'm also finding if they type \\school\ into the start menu they can see the sysvol and netlogon folders which isn't ideal!

 

Cheers, eddyc

[xlandhenry]

If what you want is to prevent running programs, isn't applocker the ultimate solution?

[Annabelle]

I asked a similar question before in the Technet forum.

 

Students were able to run "gpupdate /force" in the search even tho cmd was blocked.

The explanation given to me was that the commands that I ran were actually separate programs. They need to be blocked separately/individually.

[LemonEntry]

Uhhh... Sysvol is readable by authenticated users anyway. If you're hiding secrets in there then you're using it wrong.

[eddyc]

Uhhh... Sysvol is readable by authenticated users anyway. If you're hiding secrets in there then you're using it wrong.

 

Yes I'm aware that's the case, I would just rather stop people from having a nose if I can.

 

There's only scripts and the usual folders in sysvol and netlogon, nothing sensitive.

 

But... it's something you used to be able to stop in previous versions of Windows and something I would like to remove in our environment

[eddyc]

Yes I'm aware that's the case, I would just rather stop people from having a nose if I can.

 

There's only scripts and the usual folders in sysvol and netlogon, nothing sensitive.

 

But... it's something you used to be able to stop in previous versions of Windows and something I would like to remove in our environment

 

 

Just as an update to this incase anyone else is interested, I found that setting deny "list folder contents" on the sysvol and netlogon folders for staff and students then everything still works fine, when they type \\school\ into the Windows 10 start menu it shows sysvol and netlogon but they cannot look in these folders. Result