[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2120
  • Last Modified:

Disable access to command.com

I work in a school and I am trying to disable access to command.com using Windows Server 2003 with XP clients. I can disable access to cmd but can’t seem to find a way to disable access to command. I have been working on this issue for quite some time but cannot find an answer. I am thinking about deleting the file but am not sure of the outcome. Even if I did delete the file, a user could possibly run it from a floppy. Has anyone else encountered this problem and if so how did they solve it? Any ideas?
1 Solution
You should be able to use secpol.msc to block command.com.
This link is written for games but the same idea should apply.

Yes, an user could run the file from floppy, but if you set a group policy or security policy to prevent the user from running command.com, the user could rename the file to comm.com and is able to run the file again, so the only possibility is to disable the 16bit application subsystem through a group policy item.
User Configuration\Administrative Templates\Windows Components\Application Compatibility

Prevent access to 16-bit applications -> Enabled

Relogon with the user, and you will see, command.com cannot be started.
andyward007Author Commented:
That was just what I was looking for. Thanks.
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Walter PadrónCommented:
The answers are great, but IMHO you need more security measures than just disabling command.com
Shhhhhhh...  The students have to have SOME secrets!   :-)
andyward007Author Commented:
Thanks to Dave8555. I have blocked command.com via hash.

AllocationError - Thanks for your comment but I have tried renaming command.com and as I have blocked the hash, it still cannot run. We unfortunately run some 16 bit apps so blocking these is not an option.

IMHO - Thanks for the concern. I have used GPOs to configure the security settings and lockdown but have not played with Software Restriction Policies before. I assumed, incorrectly, that software restriction policies prevented all software running except that if it has been given a valid certificate or has been specified as allowed.

JRS_50 - I am sure the students have plenty of secrets and some of which i'm sure I don't want to know :)

Thanks alot for everyones feedback.
andyward007Author Commented:
Sorry wpadron - IMHO stuck in my mind
andyward007Author Commented:
Time to leave work.

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now