Somehow I encountered the problem that I could not start the Windows Command Prompt (cmd.exe).
The solution turns out is to remove a key from the registry. A number of posts points to the removal of
HKCU\Software\Microsoft\Command Processor\AutoRun
.
A complexity comes from the factor that the user account
is a standard user account; howeer, regedit
needs to run as an administrator, which means
the HKCU is the administrator, not the standard user.
To address this issue, we can perform the following steps
- Figure out the user's
sid
:
Thewhoami /user
sid
begins withS-
that we can easily recognize from the output. - Open
regedit
, and browse toHKEY_USERS
, to the user according to the user'ssid
, toSoftware
, toMicrosoft
, toCommand Processor
, and then locateAutoRun
, and remove it.
A StackOverflow post indicates several more keys to remove, but it is not necessary in my case, but it is good to document it, just in case in the future
reg delete "HKCU\Console" /f
reg delete "HKCU\Software\Microsoft\Command Processor" /v "AutoRun" /f
reg delete "HKLM\Software\Microsoft\Command Processor" /v "AutoRun" /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\cmd.exe" /f
No comments:
Post a Comment