Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 763
  • Last Modified:

How to hide the command prompt and RDP from accessories on a Windows 7 through AppLocker

Hi

I want to hide the command prompt and RDP from accessories on a windows 7  laptop.
Is it possible to achieve this through Applocker or any other method will be great.

Please post me some tutorial

Thanks
0
lianne143
Asked:
lianne143
  • 4
  • 3
  • 2
  • +1
4 Solutions
 
lruiz52Commented:
You can do it through group policy.
0
 
lianne143Author Commented:
This laptop will be a standalone not on the domain.
0
 
McKnifeCommented:
Hi. Applocker comes with enterprise or ultimate editions of win7. Other editions can use ntds permissions. Executables are cmd.exe and mstsc.exe
0
NFR key for Veeam Agent for Linux

Veeam is happy to provide a free NFR license for one year.  It allows for the non‑production use and valid for five workstations and two servers. Veeam Agent for Linux is a simple backup tool for your Linux installations, both on‑premises and in the public cloud.

 
lianne143Author Commented:
Do you mean denying NTFS permissions for users   for the below

C:\Windows\System32\mstsc.exe
C:\Windows\System32\cmd.exe
0
 
McKnifeCommented:
Right. But don't use deny but simply remove the permissions for"unwanted" users.
0
 
lianne143Author Commented:
Finally

We do have Microsoft EES and I have licenses for enterprise and  ultimate editions as well .
If I install these versions on the laptops, will I be able to remove CMD prompt and RDP from accessories through Applocker.
Please post any tutorials as how to do this, if possible.

Thanks for you help
0
 
Cliff GaliherCommented:
Applocker does not remove or hide applications or shortcuts. It will prevent an application from running with an error.

If you want to "hide" these things, you will need to create a new default profile for new user's, and edit the existing profiles of users that have already been on the machine.

Users could still launch applications if they found another way to reach them. Software restriction policies cannhelpnwith that (neater than applocker in this instance in my opinion.)

You'll likely need to combine the two methods above to really accomplish what you want.

---

Of course, this is where I will also point out that blocking the command  line and
RD seems like it is attacking a symptom instead of fixing an issue. If NTFS permissions are set properly, who cares if a user cannlaunch the command line? It can't get anywhere or do anything they can't do via windows explorer. Two interfaces to the same data and programs.

Similarly, if you lock down your network and firewalls, who cares if users start the remote desktop program. They can't GO anywhere with it.

I am of the mind that a workstation really needs to be locked down, default profiles and restriction policies aren't enough (public kiosks, for example) and a customized install image should be used. And in all other instances, following best practices in file and network permissions addresses those problems more neatly.

Hope that helps.
0
 
McKnifeCommented:
> Software restriction policies cannhelpnwith that (neater than applocker in this instance in my opinion
Um... what are you talking about? Applocker is neater in every respect and is kind of the successor to software restriction policies. Apart from that, SRPs can be circumvented more easily then applocker as they run in the user space.

@lianne: I would not switch editions to prevent those two things from running. Much effort and with NTFS you have the same result. Applocker is better than NTFS because of the whitelisting option, but here, you want blacklisting.
0
 
Cliff GaliherCommented:
"Um... what are you talking about?"

No need to be condescending, in will not get drawn into a debate over a purely subjective opinion. I will, however, explain my position.

Win7 allows multiple local policies, and it is not uncommon to see that feature used with non-domain-joined machines where control is desired. The desire to use applocker also clearly indicates that level of control IS desired.

Applockers merging logic is powerful, but complex, when multiple policies are involved. SRP is far more mundane in comparison,

Therefore, it is a valid opinion to believe that SRP is more elegant in some deployments.

You don't have to AGREE with that opinion. But you don't have to be a ...well...i've captained my position,
0
 
McKnifeCommented:
Dear cgaliher, it was not meant to be condescending or anything. I am sorry if I made that impression. I was simply interested what you could mean because I administer both and so far, I could not agree, quite the opposite even.
Thanks for telling me, maybe I will come across these merging scenarios some day.
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

  • 4
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now