We help IT Professionals succeed at work.

How to disable batch file execution?

8,967 Views
1 Endorsement
Last Modified: 2013-12-04
I have a Windows Server 2008. How do I disable users ability to execute batch files?
Comment
Watch Question

CERTIFIED EXPERT
Most Valuable Expert 2011
Top Expert 2011

Commented:
Change the file association for .bat/.cmd to notepad....

Add it to a Machine Startup Script....
reg add "HKEY_CLASSES_ROOT\batfile\shell\open\command" /ve /d "c:\windows\system32\notepad.exe %1" /f
reg add "HKEY_CLASSES_ROOT\batfile\shell\runas\command" /ve /d "c:\windows\system32\notepad.exe %1" /f
reg add "HKEY_CLASSES_ROOT\batfile\shell\runasuser\command" /ve /d "c:\windows\system32\notepad.exe %1" /f

reg add "HKEY_CLASSES_ROOT\cmdfile\shell\open\command" /ve /d "c:\windows\system32\notepad.exe %1" /f
reg add "HKEY_CLASSES_ROOT\cmdfile\shell\runas\command" /ve /d "c:\windows\system32\notepad.exe %1" /f
reg add "HKEY_CLASSES_ROOT\cmdfile\shell\runasuser\command" /ve /d "c:\windows\system32\notepad.exe %1" /f

Open in new window

Lee W, MVPTechnology and Business Process Advisor
CERTIFIED EXPERT
Most Valuable Expert 2013

Commented:
Did you test that on the command line?

Because on the command line, I would expect you'll need to alter your system wide environment variables so that PATHEXT no longer lists .BAT or .CMD.

Author

Commented:
Is there a Group Policy I could change to prevent batch/command files?
Lee W, MVPTechnology and Business Process Advisor
CERTIFIED EXPERT
Most Valuable Expert 2013

Commented:
Out of curiousity... WHY are you doing this?  It doesn't make much sense to me.  Batch files are important network administration tools and can make things easier for users... Perhaps there's a better way of accomplishing your end goal, if you can define what, exactly, the end goal of disabling batch scripts is.

(And I know of no group policy to disable batch files... never looked into it... )

Author

Commented:
My server has a security app running which I do not want shut down. Users are downloading batch files via FTP to the server and then executing these batch files which then are trying to kill my security app.

So I am trying to shut down FTP access (in another question) and shut down the ability to execute batch files.  
Lee W, MVPTechnology and Business Process Advisor
CERTIFIED EXPERT
Most Valuable Expert 2013

Commented:
A batch file is just commands... In my opinion, you are focusing on the wrong thing.

Who are these users?  Why are your own users attacking you?  Or do you mean hackers are hacking your system?

Your USERS should not have the right to terminate the process stop the service.  Then the batch file becomes irrelevant.  Why do you give your users admin rights?  Take those away and the batch file won't matter.
CERTIFIED EXPERT
Most Valuable Expert 2011
Top Expert 2011

Commented:
I tested launching a .bat file, and it opened it notepad......

I do agree with leew though, it is not the right way to prevent what you are trying to do..... Does anwer the actual question though...

:)

Author

Commented:
I am looking at worst case and thinking ahead. They are my users (standard rights) but they may have bad intentions at some point. One user pointed out that he could download batch files via FTP and execute them and thought I should close that hole.

So I am working on disabling FTP access. But I also wanted to prevent execution of batch files in case some gets one onto the computer.

CERTIFIED EXPERT
Most Valuable Expert 2011
Top Expert 2011

Commented:
And leew, you were correct, the cmd line still ran the batch files......

Standard users shouldnt be able to close processes running on a server though.....
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
Limit the users on the server (limited/restricted user) and maintain the system with the most current updates.

You can as others mentioned define a rule for IE not to download items.

that match a certain patern i.e. no vbs, bat, exe, etc.  if you have a firewall/porxy, you can define the rule on those There would be a load impact for URL rejection on the firewall/router..
Bassam AlmasriIT Infrastructure Specialist
CERTIFIED EXPERT

Commented:
-Using Group policy , disable *.bat [ Enable GPO>User configuration>Administrative Templates>System >Don't run specified Windows applications >*.bat

OR
- GPO>User configuration>Administrative Templates>System >Prevent access to the command prompt
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.