In enterprise environments, restricting access to critical system tools like the Windows Registry Editor (regedit.exe) and Command Prompt (cmd.exe) is essential to maintain system integrity and prevent unauthorized configurations. Microsoft Intune provides a centralized approach to enforce these restrictions across managed devices using the Settings Catalog. 

Prerequisites 

• You have administrative access to the Microsoft Intune Admin Center. 
• Target devices are running Windows 10 (version 1909 or later) or Windows 11. 
• Devices are enrolled in Intune and are either Devices are Microsoft Entra ID-joined or Hybrid joined. 

Blocking Access to Windows Registry Editor 

The Windows Registry Editor allows users to modify system configurations, which can pose security risks if misused. To prevent access: 

Step-by-Step Guide: 

1. Sign in to Intune Admin Center: 
   
   

   • Navigate to https://intune.microsoft.com. 
2. Create a New Configuration Profile: 
   
   

   • Go to Devices > Windows > Configuration profiles > + Create profile. 
   • Select Platform: Windows 10 and later. 
   • Choose Profile type: Settings catalog. 
3. Configure Profile Basics: 
   
   

   • Enter a Name: Block Windows Registry Access. 
   • Provide a Description: Prevents users from accessing the Windows Registry Editor. 
   • Click Next. 

   

4. Add Settings: 
   
   

   • In the Configuration settings tab, click + Add settings. 
   • In the Settings picker, search for Prevent access to registry editing tools. 
   • Select the setting under Administrative Templates > System. 

   

5. Configure the Setting: 
   
   

   • Set Prevent access to registry editing tools to Enabled. 
   • Set Disable regedit from running silently to Yes. 
   • Click Next. 

   

6. Assign the Profile: 
   
   

   • In the Assignments tab, choose the user or device groups to which this policy should apply. 
   • Click Next. 

   

7. Review and Create: 
   
   
   • Review the configuration settings. 
   • Click Create to deploy the policy. 

End-User Experience: 

Preventing Access to Command Prompt 

The Command Prompt can be used to execute various commands that may compromise system integrity. To restrict access: 

Step-by-Step Guide: 

1. Create a New Configuration Profile: 
   
   

   • In the Intune Admin Center, go to Devices > Windows > Configuration profiles > + Create profile. 
   • Select Platform: Windows 10 and later. 
   • Choose Profile type: Settings catalog. 
2. Configure Profile Basics: 
   
   

   • Enter a Name: Prevent Access to Command Prompt. 
   • Provide a Description: Disables access to cmd.exe for users. 
   • Click Next. 

   

3. Add Settings: 
   
   

   • In the Configuration settings tab, click + Add settings. 
   • In the Settings picker, search for Prevent access to the command prompt. 
   • Select the setting under Administrative Templates > System. 

   

4. Configure the Setting: 
   
   

   • Set Prevent access to the command prompt to Enabled. 
   • Set Disable the command prompt script processing also to No (unless you also want to block batch scripts). 
   • Click Next. 

   

5. Assign the Profile: 
   
   

   • In the Assignments tab, choose the user or device groups to which this policy should apply. 
   • Click Next. 

   

6. Review and Create: 
   
   
   • Review the configuration settings. 
   • Click Create to deploy the policy. 

End-User Experience: 

"The command prompt has been disabled by your administrator."