Command Prompt - Enable or Disable

ByLine
How to Enable or Disable the Command Prompt in Vista and Windows 7
Synopsis
This will show you how to enable or disable the command prompt with the option to also disable command scripts (.cmd and .bat files) from running for all users in Windows 7 and Vista.
How to Enable or Disable the Command Prompt in Vista and Windows 7

information   Information
This will show you how to enable or disable the command prompt with the option to also disable command scripts (.cmd and .bat files) from running for all users in Windows 7 and Vista.

The command prompt is enabled by default.
Note   Note
If you disable the command prompt and a user tries to open a command prompt window, the system displays a message explaining that a setting prevents the action. See the disabled example below.

EXAMPLE: Command Prompt Enabled
NOTE:
The top screenshot is the normal command prompt, and the bottom screenshot is an elevated command prompt.

CMD_Prompt_Enabled.jpg
RunAs_CMD_Prompt_Enabled.jpg
EXAMPLE: Command Prompt Disabled
NOTE:
You will see this message from both command prompts above when set as disabled.

Command_Prompt_Disabled.jpg





OPTION ONE
Using a REG File Download

1. To Enable Command Prompt and Scripts
NOTE: This is the default setting.​
A) Click on the download button below to download the file below.​
Enable_Command_Prompt_and_Scripts.reg
download

B) Go to step 4.​

2. To Disable Command Prompt Only and Allow Scripts
A) Click on the download button below to download the file below.​
Disable_Command_Prompt.reg
download

B) Go to step 4.​

3. To Disable Command Prompt and Scripts
WARNING: Do not prevent (disable) the computer from running batch files (Command Scripts) if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Terminal Services. They will not work afterwards if you do.​
A) Click on the download button below to download the file below.​
Disable_Command_Prompt_and_Scripts.reg
download

4. Click on Save, and save the .reg file to the Desktop.​
5. Right click on the downloaded .reg file and click on Merge.​
6. Click on Run, Continue (UAC-Vista) or Yes (UAC-Windows7), Yes, and then OK when prompted.​
7. When done, you can delete the downloaded .reg file if you like.​




OPTION TWO
Through the Local Group Policy Editor

1. Open the all users, specific users or groups, or all users except administrators Local Group Policy Editor for how you want this policy applied.​
2. In the left pane, click on User Configuration, Administrative Templates, and System. (See screenshot below)​
Group_Policy.jpg

3. In the right pane, right click on Prevent access to the command prompt and click on Properties. (See screenshot above)​
4. To Enable the Command Prompt and Scripts
A) Select (dot) Disabled or Not Configured and click on OK. (See screenshot below 5C)​
NOTE: Not Configured is the default setting.​
B) Go to step 6.​

5. To Disable the Command Prompt
A) Select (dot) Enabled.​
B) Select Yes or No from the drop down menu to Disable or Allow Command Scripts (.cmd and .bat files) to still run.​
WARNING: Do not prevent (disable) the computer from running batch files (Command Scripts) if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Terminal Services. They will not work afterwards if you do.​
C) Click on OK.​
Properties.jpg

6. Close the Local Group Policy Editor window. Your done.​





OPTION THREE
Manually in Registry Editor

1. Open the Start Menu, then type regedit in the search box and press Enter.​
2. If prompted by UAC, then click on the Continue (Vista) or Yes (Windows 7).​
3. In regedit, navigate to the location below. (See screenshot below)​
NOTE: If you do not have System in the left pane, then right click on Windows and click on New and Key. Type System and press Enter.​
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
Reg1.jpg

4. To Disable the Command Prompt
A) In the right pane, right click on a empty area and click on New and DWORD (32-bit) Value. (See screenshot above)​
B) Type DisableCMD and press Enter.​
C) Right click on DisableCMD and click on Modify. (See screenshot below)​
Reg2.jpg
D) To Disable Command Prompt Only and Allow Scripts
  • Type 2 and click on OK. (See screenshots below)
Modify2.jpg
Reg4.jpg

E) To Disable Command Prompt and Scripts
WARNING: Do not prevent (disable) the computer from running batch files (Command Scripts) if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Terminal Services. They will not work afterwards if you do.​
  • Type 1 and click on OK. (See screenshots below)
Modify1.jpg
Reg3.jpg

F) Go to step 7.​

6. To Enable Command Prompt and Scripts
NOTE: This is the default setting.​
A) In the right pane, right click on DisableCMD and click on Delete. (See screenshot above)​
B) Click on Yes to confirm deletion.​

7. Close regedit.​
That's it,
Shawn


 
Last edited:
Shawn Brink

Comments

Please help me out here. What is the purpose of Command Prompt? I have read about it but I am still confused. This is the quote from one of the sites I read "This is how computers used to work before the mouse became common. You have to type in your commands". Then why do we use it still? since we already have a mouse to get to where we want. Please make it simple.
Thanks.
 
Hi Bennys,

While the Windows GUI (interface) has made it a lot easier to work on computers than the old DOS days, the command prompt can still be very useful if you cannot use the GUI for a task for whatever reason. It oftens allow you to perform advanced actions that you normally may not be able to do. (Ex: More features for Disk Defragmenter) Plus, using an elevated command prompt will make doing certain tasks easier since it has high permission. This link will help explain the command prompt in more details though.

Search Results

Hope this helps,
Shawn
 
Hello yl89,

In the Local Group Policy Editor, when something is set a (not configured), it usually indicates that that item is allowed (enabled) to run. Most Local Group Policies will disable or restict what the policy is for when they are Enabled. In the Local Group Policy Editor, these settings are strictly to Enable (to allow and enforce), Disable (not to allow ever), (not configured) (not allow, but let settings elsewhere in Vista decide instead) the policies.

Hope this helps,
Shawn
 
the problem is.since my system have always been (not configured) it have been running smoothly untill i have been hit with a trojan called "RONTOKBRO”and my acess to regedit have been denied untill i have cleared the trojan and enable regedit in gpedit and as you said.Some setting in vista have change it descision,and i hope i can change back the setting because i do dont know which shld be set disable or enable
 
In the Local Group Policy Editor, everything is set to (not configured) by default. If it was not more than 90 days ago since your infection, it may be easier to do a System Restore using a restore point dated before the infection.
 
Ok,

What did you need to get enabled again?

If it is the command prompt, where you able to use Method Two?
 
That is why I asked. If you wish to explain further, myself or another may be able to help you solve your problem. It's your choice.
 
I suspect this disables the command prompt for all users. Is there a way to disable it for a certain user (e.g. a teenage son who likes to hack the family computer) yet keep it enabled for the administrator?
 
Hello Checksix,

Sorry, but yes this is for all user accounts.

I suppose that if he has a Standard account, you could use Parental Controls on that account to block the C:\Windows\System32\cmd.exe program file to help prevent access to the command prompt.

Hope this helps,
Shawn
 
Hi,

Thank you for the tutorial.

I have a problem that both are disabled, regedit and command prompt. Is there anyway to get past this?

Thank you
 
Changing my vistas style

I know that this is not related, but it one of your posts I noticed this and wanted to ask you.

In your screen shots your taskbar and start menu are black, how to I change my setting to have mine be black too?

Thanks in advanced,
Kevin
 
Top