Avatar of D_baker
D_baker asked on

Active Directory

Hello all,

I have a problem where children are creating a batch file and then running it. I cant stop the messenger service because of software running that uses it, also i cant stop the command prompt for script processing.  I have found an ADM file to stop VBScript, can anyone help me change or even  add to it the command prompt.

PS all i want to do really is change the default action for the file types CMD and BAT to open in notepad and not run.



CLASS MACHINE
   CATEGORY "Script_blocking"
      CATEGORY "VBSFile"
         POLICY "CScript_blocking"
                  KEYNAME !!C_VBS
             ACTIONLISTON
               VALUENAME ""
               VALUE !!CScript_cmd
             END ACTIONLISTON
                   ACTIONLISTOFF
               VALUENAME ""
               VALUE !!CScript_cmd_def
             END ACTIONLISTOFF
         END POLICY ;CScript_blocking
             POLICY "WScript_blocking"
                 KEYNAME !!W_VBS
             ACTIONLISTON
               VALUENAME ""
               VALUE !!WScript_cmd
             END ACTIONLISTON
                   ACTIONLISTOFF
               VALUENAME ""
               VALUE !!WScript_cmd_def
             END ACTIONLISTOFF
         END POLICY ;WScript_blocking
      END CATEGORY ; VBSFile

        CATEGORY "jsfile"
           POLICY "CScript_blocking"
                  KEYNAME !!C_js
             ACTIONLISTON
               VALUENAME ""
               VALUE !!CScript_cmd
             END ACTIONLISTON
                   ACTIONLISTOFF
               VALUENAME ""
               VALUE !!CScript_cmd_def
             END ACTIONLISTOFF
         END POLICY ;CScript_blocking
             POLICY "WScript_blocking"
                 KEYNAME !!W_js
             ACTIONLISTON
               VALUENAME ""
               VALUE !!WScript_cmd
             END ACTIONLISTON
                   ACTIONLISTOFF
               VALUENAME ""
               VALUE !!WScript_cmd_def
             END ACTIONLISTOFF
         END POLICY ;WScript_blocking
      END CATEGORY ; jsfile

        CATEGORY "WSHFile"
           POLICY "CScript_blocking"
                  KEYNAME !!C_WSH
             ACTIONLISTON
               VALUENAME ""
               VALUE !!CScript_cmd
             END ACTIONLISTON
                   ACTIONLISTOFF
               VALUENAME ""
               VALUE !!CScript_cmd_def
             END ACTIONLISTOFF
         END POLICY ;CScript_blocking
             POLICY "WScript_blocking"
                 KEYNAME !!W_WSH
             ACTIONLISTON
               VALUENAME ""
               VALUE !!WScript_cmd
             END ACTIONLISTON
                   ACTIONLISTOFF
               VALUENAME ""
               VALUE !!WScript_cmd_def
             END ACTIONLISTOFF
         END POLICY ;WScript_blocking
      END CATEGORY ; WSHFile

   END CATEGORY ; "Script_blocking"


[STRINGS]
CScript_cmd="%SystemRoot%\system32\NOTEPAD.EXE "%1" "
WScript_cmd="%SystemRoot%\system32\NOTEPAD.EXE "%1" "

CScript_cmd_def="%SystemRoot%\System32\CScript.exe "%1" %*"
WScript_cmd_def="%SystemRoot%\System32\WScript.exe "%1" %*"


C_VBS="SOFTWARE\Classes\VBSFile\Shell\Open2\Command"
W_VBS="SOFTWARE\Classes\VBSFile\Shell\Open\Command"

C_js="SOFTWARE\Classes\jsfile\Shell\Open2\Command"
W_js="SOFTWARE\Classes\jsfile\Shell\Open\Command"

C_WSH="SOFTWARE\Classes\WSHFile\Shell\Open2\Command"
W_WSH="SOFTWARE\Classes\WSHFile\Shell\Open\Command"
Windows Server 2003

Avatar of undefined
Last Comment
D_baker

8/22/2022 - Mon
JamesDS

You can import the ADM file into your local system policy:

From the command prompt run MMC.EXE
From the file menu select "add/remove snapin" and then press add
Add the snapin "group Policy" and select it for the local machine

Navigate to the Administrative templates section for either the user or computer configuration

From the action menu select "add/remove templates"
The new ADM file setting will appear in the container and you will be able to configure the settings from there.

Beware that these settings will apply to everyone if configured from the computer configuration so do't disable something you may want to use later

HTH Cheers

JamesDS
ASKER
D_baker

Thanks i know all about polcies and active directory but i want to know how to stop cmd and bat files from running without stopping complete script processing
ASKER CERTIFIED SOLUTION
JamesDS

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
ASKER
D_baker

Many Thanks
Your help has saved me hundreds of hours of internet surfing.
fblack61