stopping .bat and .reg files running?

Archived from groups: microsoft.public.win2000.security (More info?)

If you need to run logon/startup scripts then you are limited in what you
can do in W2K. If using XP Pro you can use Software Resriction Policies to
better manage what executeable can be run on a computer by either hash,
certificate, or path rules. --- Steve


"Fabrussio" <Fabrussio@discussions.microsoft.com> wrote in message
news:A4E968BA-4BA0-4442-AB73-407646D6B33B@microsoft.com...
>I have 'disabled registry editing tools' in the AD.....but can still run
>.bat
> files that have regedit.exe /s in them...? (although start\run\regedit is
> not
> allowed)
>
> I have disabled the command prompt but .bat files still run (although
> start
> cmd does not)
>
> I can disable .reg and .bat in allowed windows applications but I need to
> run login.bat.
>
> How can I stop these be allowd to run?
>
>