How to disable Command Prompt on Windows 10

The Windows 10 Command Prompt aka CMD is an incredibly useful tool from which you can perform pretty much any task on your system. However, this power also makes it dangerous when it’s in the wrong hands. As a result, in certain environments, you may want to disable Command Prompt entirely.

Microsoft, thankfully, is aware that if this conundrum and has provided at least two ways to block Command Prompt in Windows 10. You can simply deactivate Command Prompt via GPO (the Group Policy Editor) or make a quick registry tweak.

Today we’re going to show you how to stop Command Prompt from working using both methods. However, it’s worth pointing out that we only really recommend using the Registry if you don’t have access to the Group Policy tool. The Group Policy editor is just simpler and safer.

Advertisement

How to Disable Command Prompt via Group Policy (gpedit)

Gpedit is a favorite tool of admins when comes to blocking applications, and Command Prompt is no exception. A few clicks is all it takes to turn off CMD in Windows 10.

  1. Open the Group Policy Editor


    Press “Start” and then type “gpedit.msc”. Click the top result.

  2. Open the ‘System’ folder and double-click ‘Prevent access to the command prompt’


    You’ll find the System folder under User Configuration > Administrative Templates.

  3. Enable and save the group policy


    In the “Prevent access to the command prompt” policy, tick “Enabled”.

    You then have a choice: you can choose whether or not you want to disable the command script processing also. Turning this on will stop users from running batch files.

    Make your choice, then click “OK” and “Apply”.

    If you’re wondering how to unblock Command Prompt in the future, simply switch the policy from “Enabled” to “Disabled” or “Not Configured”.

  4. Open Command Prompt


    You should always check to ensure your policy is working correctly. Press Start, type “Command Prompt”, and click the top result.

    If you successfully deactivated the command line, you’ll get the following message:

    The command prompt has been disabled by your administrator. 
    
    Press any key to continue...

How to deactivate CMD via Registry Editor (regedit)

If you don’t have the Group Policy Editor because you’re on Windows 10 Home, you can still disable Command Prompt using your registry. Just make sure you have a quick read of our safe registry editing guide first.

  1. Open Registry Editor (regedit)


    Press Start and then type “Registry Editor” or “regedit”. Click the top result.

  2. Create a new registry Key in the Windows Policies folder


    Browse to HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows , right-click in the main pane, and select “New > Key”. Name the key “System”.

  3. Create a New DWORD inside your System key


    Navigate to your new System key and right-click in the main pane. Choose “New > DWORD (32-bit) Value”. Name the DWORD “DisableCMD”.

  4. Change the Value data to your preference and click ‘OK’


    A value data of 1 to deactivate CMD and batch files, and a value data of 2 to disable CMD while still allowing the execution of batch files. Choose whichever makes the most sense to you and press “OK”.

    Make sure you test Command Prompt to ensure it has been fully disabled. If it has, you should get the message “The command prompt has been disabled by your administrator.  Press any key to continue…”.



    Now you know how to disable Command Prompt in Windows 10, you may want to further lock down your system. You can follow our guide to disable PowerShell, or restrict the user to a single app by activating kiosk mode.

Advertisement