Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 788790" data-attributes="member: 32260">No, for the standard applications.Windows Script Host scripts are used sometimes (very rarely), for example by &#039;Intel(r) Energy Checker SDK&#039;. Blocking WSH in the home environment do not break anything important.Block Windows Script Host script execution on Windows 64-bit:[CODE]reg add &quot;HKLM\Software\Microsoft\Windows Script Host\Settings&quot; /v &quot;Enabled&quot; /t REG_DWORD /d &quot;0&quot; /freg add &quot;HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings&quot; /v &quot;Enabled&quot; /t REG_DWORD /d &quot;0&quot; /f[/CODE]The above should be executed from Administrator Command Prompt (use &#039;Run as administrator&#039;) !The Command Prompt cannot be blocked system wide, because it is used as an alternative shell in Windows (Safe Boot can start system in Command Prompt). It can be blocked per user. The below is the way to block it on the default Administrator type of account (not SUA):[CODE]reg add &quot;HKCU\Software\Policies\Microsoft\Windows\System&quot; /v &quot;DisableCMD&quot; /t REG_DWORD /d &quot;1&quot; /f[/CODE]<s>The user still can execute .bat and .cmd scripts as administrator.</s>The above reg tweak will not work on SUA (Standard User Account). On SUA one should use the similar key in the proper HKU registry hive.Yet, OneDrive uses Command Prompt to clean the leftovers after updates, Sandboxie uses it to clean the sandbox, Intel software can use it for launching igfxEM.exe or igfxHK.exe, or igfxTray.exe, etc. So, disabling Command Prompt is more tricky than disabling Windows Script Host.</blockquote>

[QUOTE="Andy Ful, post: 788790, member: 32260"] No, for the standard applications. Windows Script Host scripts are used sometimes (very rarely), for example by 'Intel(r) Energy Checker SDK'. Blocking WSH in the home environment do not break anything important. Block Windows Script Host script execution on Windows 64-bit: [CODE]reg add "HKLM\Software\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "0" /f reg add "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings" /v "Enabled" /t REG_DWORD /d "0" /f[/CODE] The above should be executed from Administrator Command Prompt (use 'Run as administrator') ! The Command Prompt cannot be blocked system wide, because it is used as an alternative shell in Windows (Safe Boot can start system in Command Prompt). It can be blocked per user. The below is the way to block it on the default Administrator type of account (not SUA): [CODE]reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v "DisableCMD" /t REG_DWORD /d "1" /f[/CODE] [S]The user still can execute .bat and .cmd scripts as administrator.[/S] [B]The above reg tweak will not work on SUA (Standard User Account). On SUA one should use the similar key in the proper HKU registry hive.[/B] Yet, OneDrive uses Command Prompt to clean the leftovers after updates, Sandboxie uses it to clean the sandbox, Intel software can use it for launching igfxEM.exe or igfxHK.exe, or igfxTray.exe, etc. So, disabling Command Prompt is more tricky than disabling Windows Script Host. [/QUOTE]

Verification