How to Completely Disable ‘Command Prompt’ (cmd.exe) via Group Policy in Windows 11

The Command Prompt (cmd.exe) is a legacy, powerful command-line interpreter that has been part of the Windows NT family for decades. While Microsoft is heavily pushing PowerShell as the modern alternative, the classic Command Prompt remains fully accessible in Windows 11. It allows users to execute batch scripts, ping IP addresses, modify network adapters, and run system diagnostics. In a corporate, educational, or highly restricted kiosk environment, exposing a raw command-line interface to standard users is incredibly dangerous. Malicious users can use cmd.exe to bypass GUI restrictions, enumerate network shares, or launch privilege escalation exploits.

This guide explains how to completely disable the Command Prompt in Windows 11 via Group Policy, preventing users from running interactive sessions or executing batch files.

Disable Command Prompt via the Group Policy Editor

The Group Policy Editor provides a robust, built-in mechanism to lock down cmd.exe. Note that this tool is only available on Windows 11 Pro, Enterprise, and Education editions. If you are using Windows 11 Home, you will need to use a Registry edit instead.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, drill down to the following path:

   User Configuration > Administrative Templates > System

5. With the “System” folder selected, look at the main pane on the right. Scroll down and locate the policy named Prevent access to the command prompt.
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled.
8. In the “Options” box directly below, you will see a dropdown menu asking: Disable the command prompt script processing also?
   • If you select Yes, the system will block both interactive command windows and the execution of .bat and .cmd batch scripts.
   • If you select No, users cannot open the command window manually, but background batch scripts deployed by IT will still run. Choose the option that fits your security model.
9. Click Apply, then click OK.

Verify the Restriction

The policy applies almost immediately. To verify the lockdown, press Windows Key + R, type cmd, and press Enter.

Instead of the familiar black terminal window appearing, a pop-up error message will immediately display stating: “The command prompt has been disabled by your administrator.” The user’s only option is to press any key to terminate the window, ensuring they have absolutely no interactive access to the legacy shell.