Restrict Command Prompt access for Windows users
On a shared Windows computer, an administrator may want to restrict selected users from running commands in Command Prompt. For example, a school may limit students’ access while allowing batch scripts needed for normal operation. Prevent access to the command prompt controls interactive Cmd.exe access and offers a separate choice for batch files.
Problems this policy can address
The policy can help prevent users, such as students on a managed computer, from running unwanted commands through the interactive command prompt. It does not establish that all harmful activity or other shells are blocked. When enabled, an administrator-disabled message appears when the prompt is launched; this is a result of the setting, not an existing error.
Steps
- Open the Group Policy editor for the intended users and go to
User Configuration › Administrative Templates › System. In a domain, link the GPO to the organizational unit containing those users. - Open the policy and select
Enabled. Choose whether to disable batch file processing, then apply the setting. - Update policy and test with a targeted user account. To undo the policy, select
DisabledorNot Configured.
Do not block batch processing when users rely on logon, logoff, startup or shutdown batch scripts, or use Remote Desktop Services. Blocking Cmd.exe can also interfere with Power Automate browser extension communication.
Registry settings
Sign in as the intended user and open Registry Editor with regedit. Before changing the key below, export it and record whether the value exists and its original data. Under this key, create or edit the DWORD value shown:
HKCU\Software\Policies\Microsoft\Windows\System
DisableCMD (REG_DWORD)
Set the value to 2 to block interactive Cmd.exe while allowing batch processing, or 1 to block both. Apply the change and test with the intended user. To restore the previous state, restore the recorded value, or delete only this value if it was originally absent. A managed policy can reapply it at refresh.
Baseline: Windows 11 version 26H2 policy templates.