Re-Enable Command Prompt Blocked by Administrator or Policy in Windows

There are several ways to prevent users from launching the Command Prompt in Windows. They are typically used by system administrators who want to restrict users’ access to the Windows command line (shell). This technique can be used by malware that has compromised a system and disabled access to the Command Prompt, making it more difficult to troubleshoot, detect, and remove malicious programs or scripts.

Suppose that when you try to open the Command Prompt (cmd.exe) or run a BAT/CMD script, the following message appears:

The command prompt has been disabled by your administrator.
Press any key to continue . . .

This clearly indicates that Command Prompt has been disabled using the DisableCMD registry option. Open the Registry Editor (regedit.exe) and navigate to HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System

If the DisableCMD value is set to 1 or 2, it prevents the user from launching the Command Prompt.

In order to allow cmd.exe to run, change the value to 0.

REG ADD HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 0 /f

However, first check whether this setting has been enabled via Group Policy. Otherwise, your registry change will be overwritten the next time Group Policy settings are refreshed.

To view the resultant Group Policy settings on a computer, press Win+R and run rsop.msc command.

In this example, you can see that the command prompt has been disabled by a local Group Policy option.

To disable this GPO setting:

1. Open the Local Group Policy Editor ( gpedit.msc )
2. Navigate to User Configuration –> Administrative Templates –> System
3. Open the Prevent access to the Command Prompt policy and disable it by setting it to Disabled or Not Configured .
4. Update the local Group Policy settings by pressing Win+R and then running the command: gpupdate /force

[/alert]

There are also two other simple ways to prevent users from launching the command prompt in Windows.

The first method is to block specific executable files. If you enable the Don’t run specified Windows applications policy under User Configuration -> Administrative Templates -> System and add cmd.exe to the list, an error will be displayed when the user attempts to run Command Prompt.

Restrictions
This operation has been cancelled due to restrictions in effect on this computer. Please contact your system administrator.

Use the rsop.msc snap-in to check whether this policy is enabled.

Administrators can also use Software Restriction Policies (SRP) or AppLocker policies to prevent specific applications from running. If either of these executable control policies is configured, attempting to launch cmd.exe will result in an error:

This app has been blocked by your administrator.

These policies are configured in the GPO editor under the section Computer Configuration -> Windows Settings -> Security Settings -> Software Restriction Policies or under Application Control Policies.

Another way to prevent users from launching a specific executable while still allowing administrators to run it is to modify the NTFS permissions for that executable.

For example, attempting to run cmd.exe may result in the following error:

Access is denied.

Or

C:\WINDOWS\system32\cmd.exe
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.

In this case, open the PowerShell.exe console and use the icacls command to check the current NTFS permissions for the file.

icacls C:\Windows\System32\cmd.exe

In this example, the output contains a DENY permission that prevents the BUILTIN\Users group from executing the file. To remove the restriction, run:

icacls C:\Windows\System32\cmd.exe /remove:d Users