Sure it is... First of all, students should not have any administrative rights on 
the PCs, which will save you loads of headaches. 


Now, a group policy can only be applied to an OU.  And the command prompt access 
policies have to be applied to users, not computers.  So, you have to place all the 
student user accounts in an OU (or use an existing one).  OUs can be nested if this 
helps.  Then create and link a new group policy to the new OU that you put the student 
accounts in, or modify an existing policy that already applies to only students.

Now, edit that group policy you just created, and navigate to the "user configuration" 
-> "administrative template" -> "system" tree.  And ENABLE the "Prevent access to 
the command prompt" policy. 

Once the policy updates, students will no longer be able to access the command prompt.

You may want to prevent them from accessing the "run" command on the start menu also 
as tecnically savvy students can still run stuff this way without using command prompt. 
 You will have to look through the policies because there are a lot that will make 
an administrator's life a lot easier when dealing with kids in a school. :)

I don't get too excessive with policies, but I definitely disable command prompt, 
disable the run item on the start menu, disable regedit, and disable changing of 
the desktop background.  And definitely, NO ADMINISTRATIVE access. 

• Reply or follow-up to this message

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum