How to block Command prompt using Intune

I have recently written a blog post on how to block registry access on Windows devices using Intune. In this blog post, we will look into blocking Command prompt (cmd.exe) access for users using Intune admin center.

There could be a number of reasons for blocking Command prompt access, for example: To Improve security on the device, due to compliance reasons or simply to prevent users from running any command on Command prompt.

This requires creating a device configuration profile and using a setting called “Prevent access to the command prompt(User)” from Settings Catalog. There is an additional setting “Disable the command prompt script processing also? (User)” which controls the execution of batch/cmd script files on the computer.

Be careful when setting Disable the command prompt script processing also? (User) to Yes as it will disable the execution of Login scripts or any execution of batch scripts on the device, If you are regularly using Login scripts, and batch script files to manage your devices, then choose No for this setting.

In the following sections of this blog post, we will look into the steps of blocking Command prompt on Windows 10/11 devices using Intune.

STEP 1 – Create a Device Configuration Profile

Let’s create a device configuration profile first and configure this setting:

• Login on Microsoft Intune admin center
• Click on Devices > Configuration profiles
• Click on + Create profile
• Platform: Windows 10 and later
• Profile type: Settings Catalog

Basics

Provide a Name and Description of the Profile. For Example:

• Name: Prevent CMD.exe access for all users
• Description: This profile will block CMD.exe on user’s devices

Configuration settings

Click on + Add settings and then search for “command prompt” in settings picker. Select “Prevent access to the command prompt(User)” to configure.

• Toggle the switch for Prevent access to the command prompt(User) to Enable it. This will not allow users to launch Command prompt on their device.

• Keep Disable the command prompt script processing also? (User) to No. This will allow Login scripts and batch files to work on the device, while still keeping Command prompt access blocked. However, If you want to take a block-all approach where execution of cmd or bat files/scripts will also be blocked, then select Yes for this setting.

Assignments

Assign this profile to an Azure AD group containing users or devices. If you add users to the Azure AD group, then the profile will get applied even if a user changes their device, But if you want to apply this profile to specific devices only then target this profile to an Azure AD group containing devices only.

Review + create

Review the profile settings and click on Create to create this policy.

Sync Intune Policies

The device check-in process might not begin immediately. If you’re testing this policy on a test device, you can manually kickstart the Intune sync either from the device itself or remotely through the Intune admin center.

Alternatively, you can use PowerShell to force the Intune sync on Windows devices. Another way to trigger the Intune device check-in process is by restarting the device.

STEP 2 – Monitoring Deployment Progress

To monitor the deployment progress of a Device configuration profile, follow below steps:

• Sign in to the Microsoft Intune admin center.
• Click on “Devices” and then select “Configuration profiles“
• Choose the Device Configuration profile you want to work with, and at the top of the page, you’ll see a quick view of the Success, Failure, Conflict, Not Applicable, and In Progress status.
• Click on “View report” to access more detailed information.

End-user Experience

Once this policy has been successfully applied to target devices, When users launch Command prompt from Start Menu or by using Run dialog box, they will receive below message on the Command prompt window.

“The command prompt has been disabled by your administrator”. Press any key to continue.

If you also want to confirm that this device configuration profile has been applied successfully in another way, then you can open the registry editor and go to HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System registry key. On the right-hand side, you will find a DWORD registry entry called DisableCMD which will be set to 2.

When you also enable Disable the command prompt script processing also? (User) by setting it to Yes. you will find DisableCMD value is set to 1.

FAQs