hi
the situation is this. i have disabled the cmd.exe for users, but they can still create a batch file,
eg
nbtstat -a <ip>
pause
and save it as a batch. eg nbtstat.bat

then they can double click on the batch and the cmd.exe runs.

how can i restrict this?
thanks