Disable cmd.exe for standard users on Windows 7 Starter edition.

You can create the following registry entry:

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe]
"Debugger"="\"C:\\windows\\system32\\cmd.exe /c exit 0\""

That basically will tell cmd.exe to simply exit whenever it runs.

I,' not sure that it's a good idea though. What if cmd.exe needs to run when installing software for example? Well it won't be able to unless you delete the reg.

Wow, Callendar, I didn’t know about that key and that’s a very clever suggestion. Though your demonstration of the key’s usage doesn’t make much sense…

If the Debugger value’s data is,

Code:

"C:\windows\system32\cmd.exe /c exit 0"

then you’re saying, whenever cmd is invoked, execute the following command string instead,

Code:

"C:\windows\system32\cmd.exe /c exit 0" C:\windows\system32\cmd.exe

Which doesn’t make sense because the path “C:\windows\system32\cmd.exe /c exit 0” won’t ever exist, and as a result Windows will report the following message upon launching cmd each time, does it not?

This is great news though. By taking advantage of this registry value, we can replicate the behaviour of the Don't run specified Windows Applications policy almost perfectly, for any application, without the need of group policy, i.e., with the following Debugger implementation,

Code:

"Debugger"="mshta.exe vbscript:code(close(MsgBox(\"This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.\",16,\"Restrictions\")))"

Pyprohly said:

This is great news though. By taking advantage of this registry value, we can replicate the behaviour of the Don't run specified Windows Applications policy almost perfectly, for any application, without the need of group policy, i.e., with the following Debugger implementation,

Code:

"Debugger"="mshta.exe vbscript:code(close(MsgBox(\"This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.\",0,\"Restrictions\")))"

Yes your suggestion is way better. Mine was intended to allow the debugger to launch cmd.exe with exit status 0. That just tells cmd.exe to exit as soon as it's launched. However I'm not sure that using debugger to launch a process with the same name as the original actually works as I intended.

I got the idea from here:

How to block applications and toolbar installers

Basically I actually use that registry key to block any desired process by name from ever running.

Pyprohly said:

This is great news though. By taking advantage of this registry value, we can replicate the behaviour of the Don't run specified Windows Applications policy almost perfectly, for any application, without the need of group policy, i.e., with the following Debugger implementation,

Code:

"Debugger"="mshta.exe vbscript:code(close(MsgBox(\"This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.\",0,\"Restrictions\")))"

So following your advice I find that this works well for me:

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe]
"Debugger"="mshta \"javascript:var sh=new ActiveXObject( 'WScript.Shell' ); sh.Popup( 'This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator', 10, 'Message!', 64 );close()\""

:)