Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 103
  • Last Modified:

Server 2012 R2 File Explorer

Hi,

We are just starting to roll out Citrix XenApp Desktops and have noticed that if you allow access to 'File Explorer' the users are able to open a 'Command Prompt' from the 'File' menu on the ribbon.  Is there a way we can either turn off the ribbon or disable the 'Command Prompt' shortcut on the ribbon?  We have already set the ribbon to start minimized but this does not stop the users from clicking on the links at the top and opening the menus.

Thanks
Chris
0
Moto_Systems
Asked:
Moto_Systems
2 Solutions
 
Sekar ChinnakannuStaff EngineerCommented:
You try same using gpo User Configuration\Administrative Templates\System or you can try the same via registry...
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System -> Select  DisableCMD and set value to 0.
0
 
Moto_SystemsAuthor Commented:
Thanks for the suggestion but due to some software that we use we are not able to disable the CMD, so would just like to hide the link.

Thanks
Chris
0
 
James RankinCommented:
You could use appsense environment manager's lock down tool to disable this entry point, but there is a licensing cost involved.
0
 
AndyIt ConsultantCommented:
Hiding it won't help, there are other ways to break out such as:

create a shortcut on the desktop to cmd.exe
using task manager file open to run cmd

anyone looking up 'breakout citrix' will find numerous ways to run cmd or other tools (such as powershell) as well as bypassing other restrictions:
https://www.pentestpartners.com/blog/breaking-out-of-citrix-and-other-restricted-desktop-environments/

It's risk vs compromise

I  agree, AppSense can help a lot but it's pricey.
1
 
James RankinCommented:
If you need the command prompt, but don't want users to be able to run it - what are you worried they will do from the command prompt? As long as they're not administrators, then most of the damaging functions should be unavailable.
2

Featured Post

 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

Tackle projects and never again get stuck behind a technical roadblock.
Join Now