Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am creating a local group policy to lockdown an XP work station. I have used "Run only allowed Windows applications" to create a whitelist of aproved apps. CMD.exe is on that list but I want to use "Prevent access to Command Prompt" to restrict normal users from using the comand prompt. That being said, I have some .cmd script files that admins use to run certain things. When I enable "Prevent access to Command Prompt" I allow access to run cmd script files.

My problem is that when I go to run one of my .cmd scripts, the infamious rescritions dialog pops up.

What am I doing wrong?

Thanks for any help!

share|improve this question
You're doing nothing wrong. Local GPOs don't have a way of preventing the user settings from applying to certain groups of users. Is the machine on a domain? –  Chris McKeown Jun 4 '12 at 20:01
Right, let me rephrase my question. Before I set any of the GPO setting listed above, I can run the script files just fine, but when I do enable these setting, I cannot run the scripts. I want to restrict the use of the command prompt but still be able to run the script files. –  lampwins Jun 4 '12 at 20:05
OK, I see what you mean. Have you looked at Software Restriction Policies? That might do what you need, but I must admit I'm not too familiar. technet.microsoft.com/en-us/library/bb457006.aspx –  Chris McKeown Jun 4 '12 at 20:12
Are you trying to make it to where when someone logs in as a local admin they are not affected by the restricted policies? Or are you trying to allow users to run scripts and still have the cmd restriction in place? –  Jesse Paxson Jun 4 '12 at 20:25
@ChrisMcKeown Okay, I will look into that! –  lampwins Jun 4 '12 at 20:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.