Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I disable the command line net command in windows server 2003? It would probably be good to do so for security purposes.

share|improve this question
2  
Can you describe the security purpose as an example? (Concern: is there actually a security issue with NET, or is the security issue something that preventing the use of NET masks, but does not address?) –  TristanK Mar 18 '11 at 3:54
    
Just as a added layer of protection in case a hacker gets shell access, so that they can't make a account for themselves. –  Bubby4j Mar 18 '11 at 15:48
2  
Only Administrators (and Power Users, which are generally recommended against due to privilege escalation possibilities) could do that legitimately - if a hacker has admin access to a box, it's already game over. –  TristanK Mar 18 '11 at 22:12
    
@TristanK: +10 on your immediately prior comment if I could. –  Evan Anderson Mar 19 '11 at 1:38
add comment

1 Answer

up vote 4 down vote accepted

The best way to disable a command is with Software Restriction Policies which will allow you to use group policy to disable the ability of a command to run for users you choose the policy to apply to.

share|improve this answer
1  
Disallowing software with Software Restriction Policy isn't very effective. All an attacker needs to do is make a copy of the disallowed program, append a single byte to the end of the program, and the program will execute w/o issue. Software Restriction Policy is really only effective when it's run in the "Deny All, Allow Exceptions" mode. –  Evan Anderson Mar 19 '11 at 1:40
    
Correct, applocker (the newest version) is more effective –  Jim B Mar 20 '11 at 15:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.