Disable access to command.com

I work in a school and I am trying to disable access to command.com using Windows Server 2003 with XP clients. I can disable access to cmd but can’t seem to find a way to disable access to command. I have been working on this issue for quite some time but cannot find an answer. I am thinking about deleting the file but am not sure of the outcome. Even if I did delete the file, a user could possibly run it from a floppy. Has anyone else encountered this problem and if so how did they solve it? Any ideas?
Who is Participating?
You should be able to use secpol.msc to block command.com.
This link is written for games but the same idea should apply.

Yes, an user could run the file from floppy, but if you set a group policy or security policy to prevent the user from running command.com, the user could rename the file to comm.com and is able to run the file again, so the only possibility is to disable the 16bit application subsystem through a group policy item.
User Configuration\Administrative Templates\Windows Components\Application Compatibility

Prevent access to 16-bit applications -> Enabled

Relogon with the user, and you will see, command.com cannot be started.
andyward007Author Commented:
That was just what I was looking for. Thanks.
Cloud Class® Course: Certified Penetration Testing

This CPTE Certified Penetration Testing Engineer course covers everything you need to know about becoming a Certified Penetration Testing Engineer. Career Path: Professional roles include Ethical Hackers, Security Consultants, System Administrators, and Chief Security Officers.

Walter PadrónCommented:
The answers are great, but IMHO you need more security measures than just disabling command.com
Shhhhhhh...  The students have to have SOME secrets!   :-)
andyward007Author Commented:
Thanks to Dave8555. I have blocked command.com via hash.

AllocationError - Thanks for your comment but I have tried renaming command.com and as I have blocked the hash, it still cannot run. We unfortunately run some 16 bit apps so blocking these is not an option.

IMHO - Thanks for the concern. I have used GPOs to configure the security settings and lockdown but have not played with Software Restriction Policies before. I assumed, incorrectly, that software restriction policies prevented all software running except that if it has been given a valid certificate or has been specified as allowed.

JRS_50 - I am sure the students have plenty of secrets and some of which i'm sure I don't want to know :)

Thanks alot for everyones feedback.
andyward007Author Commented:
Sorry wpadron - IMHO stuck in my mind
andyward007Author Commented:
Time to leave work.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.