cmd permission

You can deploy restrictive NTFS permissions using GPOs. You can use software restriction policies or applocker.
https://msdirectoryservices.wordpress.com/2012/01/13/set-ntfs-folder-permissions-using-gpo/
https://docs.microsoft.com/en-us/windows/device.../applocker/applocker-overview

How to Disable Run Command using Group Policy Editor:
http://www.itingredients.com/how-to-disable-run-command-using-group-policy-editor/

Check this post having multiple options to get this task done: https://www.sevenforums.com/tutorials/87750-run-command-enable-disable.html

As above suggested, you can use the Windows AppLocker a new feature in Windows that allows you to specify which users or groups can run particular applications in your organization based on unique identities of files: https://technet.microsoft.com/en-us/library/dd759117.aspx

Hope this helps!

Thanks Bro for the answer .............