Clickfix - Best practice method to disable terminal, cmd, powershell, and run prompts for standard users?

Question

Clickfix - Best practice method to disable terminal, cmd, powershell, and run prompts for standard users?

Alex Turner 60

Users basically have zero reason to launch these. If anything an admin might run them. Whats the best practice for fully disabling the ability for users to launch these easily? Trying to get ahead of clickfix attacks.

0 comments

1 answer

Your answer

Answer 1

Hello Alex,
The best practice is to enforce execution control at the OS level rather than relying on UI restrictions. Use Group Policy under User Configuration → Administrative Templates → System to disable access to the “Run” command and block the Command Prompt. For PowerShell and cmd, create AppLocker rules targeting %SystemRoot%\System32\cmd.exe, %SystemRoot%\SysWOW64\cmd.exe, and both PowerShell paths, applying Deny rules to standard user groups.

If you want stronger enforcement, Windows Defender Application Control (WDAC) provides kernel-level blocking of these binaries. Always exclude administrators so they retain access, and test carefully since some applications may spawn cmd or PowerShell silently. This layered approach ensures standard users cannot launch shells directly, mitigating clickfix-style attacks.

Harry.