Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am creating an application whitelist in a local group policy and need to be able to run cmd script files. Simply adding cmd.exe, wscript.exe, or cscript.exe to the whitelist does not effect anything. my script files have the .cmd extention. Is there a different application that handles .cmd script files?

share|improve this question
As far as I can tell from this discussion it's cmd.exe:… – smcg Jun 5 '12 at 19:04
up vote 6 down vote accepted

The binary cmd.exe is the default interpreter for .CMD files.

As the file extension CMD is listed as a default Designated File Type in a Software Restriction Policy, you will need to whitelist the CMD files themselves, not just cmd.exe. You can do this by either creating a path rule to allow just specific, or all, CMD files.

If you want to allow any CMD to run from anywhere, you may also remove the CMD entry from the Designated File Types dialog. This will allow SRP to skip processing these file types.

enter image description here

share|improve this answer
This did the trick! Thank you for the excellent explanation as well, always helps to understand something. – lampwins Jun 5 '12 at 20:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.