Windows Command Prompt is a reliable solution for administrators to quickly and easily keep your system up and running. The average user rarely uses the command line.
Rather than be tempting, many administrators prevent command line access to dissuade users from troubleshooting computer errors and looking for places where they might compromise the integrity of the system.
Windows command prompt
The Windows Command Prompt (sometimes called the DOS prompt) is a tool that allows administrators to create batch functions, fix computer errors, and invoke system-wide commands to make administration easier and more efficient. The average user makes little use of this tool.
You can find tips on how to fix errors on your Windows PC on the Internet. Some users take it upon themselves to troubleshoot and correct their own mistakes, rather than waiting for professional help.
Some administrators make it easy for themselves and prevent users from accessing the command line instead of restricting specific features for each feature. Preventing access to the command line is a quick way to ensure that users aren’t poking around in places they shouldn’t be poking around.
Disable Windows Command Prompt via Group Policy
Note. This method described below will work on Windows Vista, Windows 7, and Windows 8/10, but will not work for Home or Starter editions as they do not include support for Group Policy editing. In these cases, you can use the registry method mentioned below.
Log in to Windows using an account with administrator rights. Click Start Run to open the Run dialog box. If you don’t see the Run command in the Start menu, hold down the Windows key on your keyboard and press R. In the Run box, type gpedit.msc and click OK.
In the left pane of the Local Group Policy Editor window, open the folder under User Configuration Administrative Templates System. Make sure to click on the system folder, not expand it.
In the right pane, locate and double-click the entry that says “Deny command line access.”
You should now see the Deny Command Prompt window. As with most Windows installations, this setting should be set to Not Configured. Select the Enabled option and click OK.
Close all other open windows and you’re done. You do not need to restart your computer for the settings to take effect. All PC users are now denied access to the command line.
Disable access to command prompt via registry
If you don’t have access to Group Policy settings, you can manually enter the registry and disable the command line. To do this, you first need to back up your registry in case something goes wrong.
Go ahead and open Registry Editor by clicking Start and typing regedit. Navigate to the following path:
HKEY_CURRENT_USER Software Policies Microsoft Windows
You will see several keys under the Windows key, but probably not System. If Windows does not have a System Key, you need to create one. This can be done by right-clicking Windows and choosing New – Key.
Name the key System, select it, then right-click in the right pane and select New – DWORD (32-bit) Value.
Name the value DisableCMD and press Enter. Then double-click it to edit it, select Decimal and set it to 2. This means you only need to disable the command line. A value of 0 enables the command line, and a value of 1 disables the command line and prevents scripting.
The change should take effect immediately. If you try to open a command prompt, it appears, but with the following message:
Although the Command Prompt is a useful administration tool, few casual Windows 7 users use it. Rather than deny access to operating system functions individually, many administrators choose to prevent access to the command line using one of the methods described above. Enjoy!