asked on

Disable access to command.com

I work in a school and I am trying to disable access to command.com using Windows Server 2003 with XP clients. I can disable access to cmd but can’t seem to find a way to disable access to command. I have been working on this issue for quite some time but cannot find an answer. I am thinking about deleting the file but am not sure of the outcome. Even if I did delete the file, a user could possibly run it from a floppy. Has anyone else encountered this problem and if so how did they solve it? Any ideas?

ASKER CERTIFIED SOLUTION

dave8555

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

allocationerror

Yes, an user could run the file from floppy, but if you set a group policy or security policy to prevent the user from running command.com, the user could rename the file to comm.com and is able to run the file again, so the only possibility is to disable the 16bit application subsystem through a group policy item.
User Configuration\Administrative Templates\Windows Components\Application Compatibility

Prevent access to 16-bit applications -> Enabled

Relogon with the user, and you will see, command.com cannot be started.

andyward007

ASKER

That was just what I was looking for. Thanks.

Walter Padrón

The answers are great, but IMHO you need more security measures than just disabling command.com

jrs_50

Shhhhhhh... The students have to have SOME secrets! :-)

andyward007

ASKER

Thanks to Dave8555. I have blocked command.com via hash.

AllocationError - Thanks for your comment but I have tried renaming command.com and as I have blocked the hash, it still cannot run. We unfortunately run some 16 bit apps so blocking these is not an option.

IMHO - Thanks for the concern. I have used GPOs to configure the security settings and lockdown but have not played with Software Restriction Policies before. I assumed, incorrectly, that software restriction policies prevented all software running except that if it has been given a valid certificate or has been specified as allowed.

JRS_50 - I am sure the students have plenty of secrets and some of which i'm sure I don't want to know :)

Thanks alot for everyones feedback.

andyward007

ASKER

Sorry wpadron - IMHO stuck in my mind

andyward007

ASKER

Time to leave work.