Although, on Windows 11 (and 10), the Command Prompt console is a useful tool to quickly execute commands to change system settings, run non-graphical applications, troubleshoot problems, and automate tasks, sometimes, it might be necessary to disable the console to prevent users from running unwanted commands, accessing certain programs, or when you have to comply with your organization security policies.
If you must restrict access to the Command Prompt, Windows 10 (and 11) includes at least two ways to disable the console, using the Group Policy Editor or Registry Editor. (The user will still be able to launch the Windows Terminal, but the Command Prompt shell won't work.)
In this how-to guide, I will explain two ways to disable the Command Prompt console for all users.
Warning: This is a friendly reminder that editing the Registry is risky, and if you do not complete the task correctly, it can cause irreversible damage to your installation. It is recommended that you make a full backup of the device before proceeding.
How to disable Command Prompt with Group Policy
On Windows 10 (or 11) Pro, Enterprise, and Education, the easiest way to block users from using Command Prompt is with the Local Group Policy Editor.
To disable the Command Prompt shell on Windows, use these steps:
- Open Start.
- Search for gpedit.msc and select the top result to open the Local Group Policy Editor.
- Browse the following path: User Configuration > Administrative Templates > System
- On the right side, double-click the Prevent access to the command prompt policy.
- Select the Enabled option.
- (Optional) Under the "Options" section, use the drop-down menu to select whether you want to allow or deny running batch files (.bat and .cmd) on your computer when Command Prompt is disabled.
- Quick note: If the computer has batch files running at logon, logoff, startup, and shutdown, or use remote desktop services, it is not recommended to disable this feature.
- Click the Apply button.
- Click the OK button.
Once you complete the steps, users can still open the console, but they will receive a "The command prompt has been disabled by your administrator" message with an option to press any key to terminate the session. Also, Command Prompt will no longer process compatible scripts, depending on your configuration.
If you no longer need to restrict access to Command Prompt, you can undo the changes using the same instructions outlined above, but on step 5, make sure to select the "Not configured" option.
How to disable Command Prompt from Registry
If you do not want to use the Local Group Policy Editor or your computer has the Home edition of Windows, you can still disable Command Prompt with the Registry.
To disable Command Prompt with the Windows 11 (and 10) Registry, use these steps:
- Open Start.
- Search for regedit and click the top result to open the Registry Editor.
- Browse the following path: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows
- Quick tip: In the Operating System, you can now copy and paste the path in the Registry's address bar to quickly jump to the key destination.
- Right-click the Windows (folder) key, select the New submenu, and choose the Key option.
- Name the key System and press Enter.
- Right-click the System (folder) key, select the New submenu, and choose the DWORD (32-bit) Value option.
- Name the key DisableCMD and press Enter.
- Double-click the newly created DWORD and set the value from 0 to 2 to disable Command Prompt while allowing batch files to run on the device.
- (Optional) Double-click the newly created DWORD and set the value from 0 to 1 to disable Command Prompt while preventing batch files from running on Windows 11 (and 10).
- Click the OK button.
- Restart your computer.
After you complete the steps, the Command Prompt will be disabled for all users. Also, depending on your configuration, users will no longer be able to run batch files scripts.
In the case you want to undo the changes, use the same instructions outlined above, but on step 4, right-click and delete the System key. However, if the "System" key has additional settings, it is recommended to either set the DisableCMD DWORD value from 1 or 2 to 0 or right-click and delete the DWORD instead of deleting the "System" key.
This guide focuses on disabling Command Prompt for all users, but these instructions can also be used to restrict access to the console for specific users.
More resources
For more helpful articles, coverage, and answers to common questions about Windows 10 and Windows 11, visit the following resources:
