use security administrator to set rights for each and every user. it blocks both cmd and command.com