• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 767
  • Last Modified:

How to hide the command prompt and RDP from accessories on a Windows 7 through AppLocker

Hi

I want to hide the command prompt and RDP from accessories on a windows 7  laptop.
Is it possible to achieve this through Applocker or any other method will be great.

Please post me some tutorial

Thanks
0
lianne143
Asked:
lianne143
  • 4
  • 3
  • 2
  • +1
4 Solutions
 
lruiz52Commented:
You can do it through group policy.
0
 
lianne143Author Commented:
This laptop will be a standalone not on the domain.
0
 
McKnifeCommented:
Hi. Applocker comes with enterprise or ultimate editions of win7. Other editions can use ntds permissions. Executables are cmd.exe and mstsc.exe
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
lianne143Author Commented:
Do you mean denying NTFS permissions for users   for the below

C:\Windows\System32\mstsc.exe
C:\Windows\System32\cmd.exe
0
 
McKnifeCommented:
Right. But don't use deny but simply remove the permissions for"unwanted" users.
0
 
lianne143Author Commented:
Finally

We do have Microsoft EES and I have licenses for enterprise and  ultimate editions as well .
If I install these versions on the laptops, will I be able to remove CMD prompt and RDP from accessories through Applocker.
Please post any tutorials as how to do this, if possible.

Thanks for you help
0
 
Cliff GaliherCommented:
Applocker does not remove or hide applications or shortcuts. It will prevent an application from running with an error.

If you want to "hide" these things, you will need to create a new default profile for new user's, and edit the existing profiles of users that have already been on the machine.

Users could still launch applications if they found another way to reach them. Software restriction policies cannhelpnwith that (neater than applocker in this instance in my opinion.)

You'll likely need to combine the two methods above to really accomplish what you want.

---

Of course, this is where I will also point out that blocking the command  line and
RD seems like it is attacking a symptom instead of fixing an issue. If NTFS permissions are set properly, who cares if a user cannlaunch the command line? It can't get anywhere or do anything they can't do via windows explorer. Two interfaces to the same data and programs.

Similarly, if you lock down your network and firewalls, who cares if users start the remote desktop program. They can't GO anywhere with it.

I am of the mind that a workstation really needs to be locked down, default profiles and restriction policies aren't enough (public kiosks, for example) and a customized install image should be used. And in all other instances, following best practices in file and network permissions addresses those problems more neatly.

Hope that helps.
0
 
McKnifeCommented:
> Software restriction policies cannhelpnwith that (neater than applocker in this instance in my opinion
Um... what are you talking about? Applocker is neater in every respect and is kind of the successor to software restriction policies. Apart from that, SRPs can be circumvented more easily then applocker as they run in the user space.

@lianne: I would not switch editions to prevent those two things from running. Much effort and with NTFS you have the same result. Applocker is better than NTFS because of the whitelisting option, but here, you want blacklisting.
0
 
Cliff GaliherCommented:
"Um... what are you talking about?"

No need to be condescending, in will not get drawn into a debate over a purely subjective opinion. I will, however, explain my position.

Win7 allows multiple local policies, and it is not uncommon to see that feature used with non-domain-joined machines where control is desired. The desire to use applocker also clearly indicates that level of control IS desired.

Applockers merging logic is powerful, but complex, when multiple policies are involved. SRP is far more mundane in comparison,

Therefore, it is a valid opinion to believe that SRP is more elegant in some deployments.

You don't have to AGREE with that opinion. But you don't have to be a ...well...i've captained my position,
0
 
McKnifeCommented:
Dear cgaliher, it was not meant to be condescending or anything. I am sorry if I made that impression. I was simply interested what you could mean because I administer both and so far, I could not agree, quite the opposite even.
Thanks for telling me, maybe I will come across these merging scenarios some day.
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

  • 4
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now