How to Disable Access to the Command Prompt for Standard Account?

Command Prompt (CMD) is a command-line interpreter application for the Windows operating system that is used by administrators to execute commands and perform advanced administrative functions. There is a set of defined commands that are used to accomplish different tasks through the command prompt. It also allows users to bypass most of the restrictions that are enforced on the Windows explorer based GUI. However, you can also disable the command prompt for a standard user account. This will help in preventing command prompt from inexperienced users and kids. In this article, we will show you methods through which you can easily disable command prompt on a standard account.

Disabling Access of Command Prompt through the Local Group Policy Editor

The Group Policy is a Windows feature that enables administrators to control what the other users are allowed to do in Windows. The local in the name refers to the computer that you are working on. It is very easy to use, all you need to know is the path of the setting that you want to enable. Each setting in the Group Policy also provides the details about that specific setting. This setting is only available in the User Configuration category.

However, the Group Policy isn’t included in the Windows Home editions. Skip this method if you are using the Windows Home operating system.

1. Open a Run command dialog box by pressing the Windows and R keys together on your keyboard. Type “gpedit.msc” in it and press the Enter key to open the Local Group Policy Editor.

   

2. In the Local Group Policy Editor window, you need to navigate to the following path:

   User Configuration\ Administrative Templates\ System\

   

3. Double-click on the setting named “Prevent access to the command prompt” and it will open in another window. Now change the toggle option from Not Configured to Enabled. You can also disable the command prompt script processing by choosing the Yes option.

   

   Note: Choosing the Yes option will prevent the execution of batch files. Choosing the No option will allow the execution of batch files.

4. After enabling it, click on the Apply/Ok button to save changes. This will disable the command prompt from that standard user’s account.
5. To enable it back, you need to change the toggle option back to Not Configured or Disabled.

Disabling Access of Command Prompt through the Registry Editor

The alternative method will be using the Registry Editor for disabling the command prompt. Basically, the Group Policy Editor updates the Registry when we enable the setting. However, if you are using the Windows Home edition, then you can directly configure the setting in the Registry Editor. It will require a few extra steps for creating a missing key/value for that specific setting.

Note: We always recommend users to create a backup before making any new changes to the Registry.

1. Open a Run command dialog box by pressing the Windows and R buttons together on your keyboard. Now type “regedit” in it and press the Enter key to open the Registry Editor.

   

   Note: Click on the Yes button if prompted by the UAC (User Account Control) dialog.

2. In the Registry Editor window, navigate to the following path:

   HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System

3. Right-click on the right pane and choose the New > DWORD (32-bit) Value option. Name this newly created value as “DisableCMD“.

   

4. Open the value by double-clicking on it and change the value data to 1.

   

   Note: Value data 1 will select the Yes option for disabling the command prompt script processing. If you want to set the No option, then set the value data as 2.

5. After changing the value, make sure you restart your system to apply the changes. This will disable the command prompt for that standard user account.
6. To enable it back anytime in the future, change the value data to 0 or remove the value from the Registry Editor.