Block CMD prompt with Intune
Group Policy admins have been blocking access to command prompt for standard users since the beginning. That is why it is frustrating for MDM admins having no native way in Intune to block it in the same fashion of Group Policy. Well in actuality, you can block the cmd prompt, it just takes a custom profile, which is something that not everyone likes to do much. Below is how you set it up so feel free to use the settings.
OMA-URI: ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/IntuneEdu/EXE/Policy
Data Type: String (XML file)
Here is the XML code to paste in:
<RuleCollection Type="Exe" EnforcementMode="NotConfigured">
<FilePathRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="(Default Rule) All files" Description="Allows members of the local Administrators group to run all applications." UserOrGroupSid="S-1-5-32-544" Action="Allow">
<Conditions>
<FilePathCondition Path="*" />
Conditions>
FilePathRule>
<FilePathRule Id="ce9d9fd5-d765-48df-b87b-e1bafd5653ed" Name="All files" Description="Allows members of the Everyone group to run applications that are located in any folder." UserOrGroupSid="S-1-1-0" Action="Allow">
<Conditions>
<FilePathCondition Path="*" />
Conditions>
<Exceptions>
<FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="MICROSOFT® WINDOWS® OPERATING SYSTEM" BinaryName="CMD.EXE">
<BinaryVersionRange LowSection="*" HighSection="*" />
FilePublisherCondition>
Exceptions>
FilePathRule>
RuleCollection>
Comments (1)
Ryan Dorman
Is there a way to force the Application Identity service to start? I can't enforce AppLocker policies without it and all of my Windows 10 machines have it configured as Manual (Triggered) out of the box.