3

I would like to know how to restrict a single (non-admin) user from using specific commands from command prompt. For example: dir should be allowed, but shutdown should be blocked. As a bonus, is this possible in a whitelist (i.e. all commands are blocked except dir)?

6

Unlike UNIX/Linux operating systems, Windows has two types of commands: internal and external. Commands like dir, cd, rd, copy, del, etc. are built into the command interpreter and are thus internal commands. All other command-line utilities (like net, shutdown, telnet, ftp, etc.) are external commands -- they have an associated .exe file. You can get a list of internal commands by typing help at a command line.

Internal commands are an all-or-nothing deal. If you grant access to the command prompt, you grant access to them all. External commands are just programs like any other, so if you don't want a user running the ipconfig command, you can just revoke read permissions to it by that user.

However, you should know that the command line is not magic. It cannot and does not allow a user to do something they ordinarily wouldn't be able to do. The functions the command line exposes are still governed by the security on the system. A user that does not have read/write access to a folder cannot use rd or del to delete it. If they do not have read access to a folder, they cannot cd into it.

I would advise you to really think about what you're trying to accomplish. Blocking a command is like removing a door knob. It doesn't prevent the door from being opened. If you wanted to secure a door, you'd lock it.

Let's say you want to block access to the shutdown command for your users. That does not stop them from shutting down the system. There are literally a dozen ways to shut a computer down. All you're doing is blocking one particular way. Instead, you should use the security policy to deny users the right to shut the computer down. That way, ANY attempt to shut the machine down will be blocked -- regardless of how they try to do it. This is the default policy on servers.

Changing the default security permissions in the Windows directory is generally a bad idea also. It could have ramifications you wouldn't even think of. And they may not be immediately apparent.

1

Fire up the editor by typing secpol.msc in the run dialogue and navigating to Application Control Policies and then AppLocker and Executable Rules

Right Click and Create Executable Rules and Next and select the users you want to allow or deny. Then File Path and Next then Browse Files and use *.*. You may give it a name and a comment by clicking Next or just click Create.

You can also say Deny user X for *.* under file/folder/path. However, then you will have to white list all Apps including word,firefox, and even standard windows tools.

Say Yes to create the default rules.

You need to move the new rules to the top of the list so they take precedence over the other rules.

Note: Shutdown is an EXE so it will block it. However, native DOS commands like CD,MD,RD are part of DOS so they will not be blocked this way. Read-only file permission can block these on files/folders that shouldn't have write permissions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.