cmd Windows 10

[Jawloms]

I've rolled out Windows 10 in a couple of our suites and now the students are back, some of them are getting in to cmd.exe. How?? They can't on the Windows 7 machines. Anyone got any suggestions please? They are simply clicking the search magnifying glass, typing "cmd" and then clicking on the result!

 

Thank you

 

Stuart

[Passat1983ICTech]

group policy have a look at this ive seen in there to stop it

[3s-gtech]

This has been covered many, many times and you'll need to do a good search of the forum. Windows 10 setup is not simple, is not entirely GP managed, and is never really finished. You'll always find loopholes. To stop CMD you'll need to use the GP 'Don't run specified Windows applications' under System. You also need to lock at Applocker. Your users can almost certainly get to Powershell plus several other programs under Windows\System32 that you really don't want them to have.

[kennysarmy]

I've rolled out Windows 10 in a couple of our suites and now the students are back, some of them are getting in to cmd.exe. How?? They can't on the Windows 7 machines. Anyone got any suggestions please? They are simply clicking the search magnifying glass, typing "cmd" and then clicking on the result!

 

Thank you

 

Stuart

 

I'd always advocate doing as much testing as possible before rolling out any new OS's to the students!

 

Too late for you I know, but here we get some of the interested students in my office for a week during lunchtimes to try and "break/hack" our images so we can patch/lock down as much as possible before we deploy out!

 

As has been said though, there are many threads on here about how to lock down Windows 10

[sonofsanta]

Under GPO, User Config > Admin Templates > System > Prevent access to the command prompt. You'll also want to set Prevent access to registry editing tools while you're there.

 

I can still get cmd up on the Start Menu, despite the shortcut being in no redirected menus and various other GPOs set to stop such nonsense, but all it does is open a CMD window that says The command prompt has been disabled by your administrator, so whatever. Too many other problems getting this OS into shape to worry about that right now!

Edited September 12, 2018 by sonofsanta

[Jawloms]

I'd always advocate doing as much testing as possible before rolling out any new OS's to the students!

 

Too late for you I know, but here we get some of the interested students in my office for a week during lunchtimes to try and "break/hack" our images so we can patch/lock down as much as possible before we deploy out!

 

As has been said though, there are many threads on here about how to lock down Windows 10

 

We did! They can't get to PowerShell, Xbox, or anything else we don't want them to. I just didn't think to check the command prompt as Impero blocks it on all the W7 devices. I know you should never assume, but alas that is what I did. This thread is not so much a "How do I" as I'm aware of GPOs etc, it's more a "WTF? It blocks OK on W7!".

Edited September 12, 2018 by Jawloms

[FishCustard]

If they're regular users and permissions on things are set appropriately, they can't do much with the command prompt that they wouldn't be able to do otherwise. It looks like a security hole, but it's not as big a deal as you may first think.

[mavhc]

Can't learn about computers without a command line anyway

[Jawloms]

You're right in that there's nothing they can do particularly, but it doesn't stop them trying when they should be on task.

[3s-gtech]

Can't learn about computers without a command line anyway

That is an impressively wrong statement. What about computers that don't have one? However, allowing access to it on your workstations isn't necessarily a good idea. It may suit to enable it in a walled garden environment though.

[mavhc]

That is an impressively wrong statement. What about computers that don't have one? However, allowing access to it on your workstations isn't necessarily a good idea. It may suit to enable it in a walled garden environment though.

 

Which computers are those?