Currently we are using Teamviewer 9. We have a couple of desktop machines that are locked down in the following manner:

1). The shell is no longer explorer.exe, it is a custom program we have created.

2). The OS is Windows 7 embedded, latest version, latest security patches.

3). The user logs on one of two ways: Admin mode which allows the windows shell and full computer access for troubleshooting, the other way is via the user logon which runs our custom run software and prevents the user from running the windows shell.

We found some holes though. At various mostly predictable times (when the support person exits a Teamviewer session on a locked down computer with the locked down user logged on) the Teamviewer dialog pops up on the client computer. In this Teamviewer dialog there is an options button that looks like a little gear icon. This icon would be the same as the options under the Extras menu on a regular Teamviewer panel (ours are customized and hence only shows a gear icon). When the user enters this settings dialog and chooses the video option on the left and then presses the select image button, the user can then enter cmd.exe (which will run a command shell), enter explorer.exe to run the shell. If they run the cmd.exe or explorer this will allow them to run IE, or ftp.exe.

Since these machines are internet connected via cellular modems we would rather that the user not be able to run these programs. Previous experience has taught us that these users log into their own Netflix accounts and watch movies and various things like that, which when run via cellular data connections could be very expensive in a very short period of time.

We investigated the possibility of using the group policy but from what our research has shown us the group policy only works if the shell is running. We could be wrong of course, but that is the information I have been given while making this post. Now if we could lock the shell down to the point where it could do NOTHING but run the program we want it to run including anything from USB while the locked down user is logged in, we would consider that, but that level of lockdown did not seem possible from our research.

If anyone knows of some good documentation on achieving this level of lockdown on a computer (similar in most respects to the level of lockdown you would want to see on a bank teller machine) we would be most interested in this information.

  • Specifically what policies in Group Policy have you tested? Also, you don't mention it, but do I correctly assume these machines are domain-joined? Aug 7, 2014 at 21:53
  • This really isn't a Teamviewer security question, or a general security question, but rather a Windows shell question.
    – schroeder
    Aug 7, 2014 at 22:39
  • Rename cmd.exe and explorer.exe?
    – schroeder
    Aug 7, 2014 at 22:43
  • 1
    If you're creating your own custom shell for Windows you could always have some fun and write a hook for CreateProcess. Check if the process being created is on a blacklist and if it is just return without forwarding on for creation. Kind of naive, but might work for your purposes.
    – RoraΖ
    Aug 8, 2014 at 11:47

2 Answers 2


(Of course this must be done on some sort of admin/power user account)

You could probably use the regular NT permissions, and deny access to cmd.exe and explorer.exe. In regular properties>permissions (you may have to enable NT permissions, also in properties).

You wouldn't need to have Group Policy necessarily. Or from command line you could use icacls "cmd.exe" /deny Users:F (Someone error check me?) and same command with where explorer.exe replaces cmd.exe.

Excuse me if I get some things wrong I am on a Linux box right now, doing this from memory.

  • A deny on Users would also be a deny on Administrator right?
    – squareborg
    Sep 7, 2014 at 7:23
  • @Shutupsquare Unless Administrator is part of the Users group (usually it is part of the Administrators group)
    – No Time
    Sep 10, 2014 at 2:50
  • "NT AUTHORITY\Authenticated Users" is part of the Users group and Administrator is an authenticated user.
    – squareborg
    Sep 10, 2014 at 8:34
  • @Shutupsquare I assumed that the Authenticated Users group would be modified, for security. You are right by default.
    – No Time
    Sep 11, 2014 at 1:44

This sounds like what you really want to do is whitelist applications. Windows 7 has AppLocker, Although I am not sure if Win 7 embeded has or not.

You can read more here

Its main points are

Prevent unlicensed software from running in the desktop environment if the software is not on the allowed list

Prevent vulnerable, unauthorized applications from running in the desktop environment, including malware

Stop users from running applications that needlessly consume network bandwidth or otherwise affect the enterprise computing environment

Prevent users from running applications that destabilize their desktop environment and increase help desk support costs

Provide more options for effective desktop configuration management

Allow users to run approved applications and software updates based upon policies while preserving the requirement that only users with administrative credentials can install or run applications and software updates

Help to ensure that the desktop environment is in compliance with corporate policies and industry regulations

Not the answer you're looking for? Browse other questions tagged .