Restricting Batch Files

[playaj20008]

Hi,

I am a student at a high school in Georgia. I recently started using batch files to get into command prompt and use net send and do other restricted activites. I never did anything for the purpose of harming the schools system, I just did it for the sake of knowing how. Well today I accidentally used an asterix instead of the computer name when using net send, and ended up sending the message "Hi" to every computer in the county. I new that they would trace it to me, so I turned myself in to the school IT guy. He let me off the hook because I turned myself in, but asked me to look into a way to block this security flaw. So here's my question (sorry for the long into). Is it possible to restrict users from being able to create batch files. I know wordpad and notpad can be blocked, but it would be better if I could some how restrict their creation all together. Any Ideas?

[cozofdeath]

:lol: I recently had the same thing happen except just my class including the instructor got the message, they were in a separate domain. Batch file and the command prompt are sort of different things. Batch file could be blocked by putting permissions on .bat file extensions. As for the command prompt just disable messaging (net stop messenger). The schools IT should of been quick to know how to fix something like this because hes the one that controls the permissions and what services/protocols are enabled. We used to joke around with virtual server/pcs too, man was that fun.

Oh. heres a better way to disable .bat files all together.

Hive: HKEY_CURRENT_USER

Key: Software\Policies\Microsoft\Windows\System

Name: DisableCMD

Type: REG_DWORD

Value: 0 enable command prompt and batch files

Value: 1 disable command prompt and batch files

Value: 2 disable command prompt but allow batch files

[playaj20008]

:lol: I recently had the same thing happen except just my class including the instructor got the message, they were in a separate domain. Batch file and the command prompt are sort of different things. Batch file could be blocked by putting permissions on .bat file extensions. As for the command prompt just disable messaging (net stop messenger). The schools IT should of been quick to know how to fix something like this because hes the one that controls the permissions and what services/protocols are enabled. We used to joke around with virtual server/pcs too, man was that fun.

What will happen when someone attempts to save something as a batch file under those conditions?

I just attempted to find that key on my work computer, but there was no Windows key after microsoft (Software\Policies\Microsoft\Windows\System). Is this mistake on your part or does my work have it hidden?

[cozofdeath]

The method I posted above will work. Its better than digging through the policy editor to find something that will just change that same key probably. But you must be an Administrator or have the correct permissions to enter and change a registry value.

[playaj20008]

The method I posted above will work. Its better than digging through the policy editor to find something that will just change that same key probably. But you must be an Administrator or have the correct permissions to enter and change a registry value.

Ahhh that probably it, im on a network login at work. Must not show all of the keys. Thanks for the help.

[cozofdeath]

When someone try to create/save a batch file they should receive an error about not having the correct permissions.

Are you using xp home?

You may be able to create the key.

[playaj20008]

When someone try to create/save a batch file they should receive an error about not having the correct permissions.

Are you using xp home?

You may be able to create the key.

No I'm on professional. But if i was on home how would I do it, I love to learn something new. Actually any usefull tricks are welcome =)

[cozofdeath]

Ok, Start, run, regedit. The navigate to the Microsoft key in the USER hive. Right Click on it and create a key called Windows, then right click the newly created Windows key and create another called System. Left click on System, then right click on the whitespace on the right side and create a new dword value named DisableCMD and set its value to 1. When you run the command prompt it will say "The command prompt has been disabled by your administrator." When you run a batch file it will say the same.

[playaj20008]

Ok, Start, run, regedit. The navigate to the Microsoft key in the USER hive. Right Click on it and create a key called Windows, then right click the newly created Windows key and create another called System. Left click on System, then right click on the whitespace on the right side and create a new dword value named DisableCMD and set its value to 1. When you run the command prompt it will say "The command prompt has been disabled by your administrator." When you run a batch file it will say the same.

Thanks alot, you've been so much help. Can I have your e-mail adress for future occurances. I'm only 16 so I'm sure I have alot to learn.

[cozofdeath]

Sure, I'm sure we can help each other with some fun things. I'm always trying to learn something new too. Anyway my email is mpmpl [@] hotmail.com You should stick around the forum, I've learn a lot here.