Bdtyktl

Say that an organization has a closed network - only its own computers can access it. Each of these computers has Windows 10 Enterprise. For obvious reasons, users aren't given administrator privileges. Anyone within the organization can easily get physical access to one of these devices. The organization is large enough (think university or big corporation) that users shouldn't be trusted.

What are the advantages of blocking cmd.exe? That is, what could a user do (bypassing filters, infecting other devices, installing unapproved software, etc.) from a non-elevated Command Prompt that they couldn't do without it?

No network is completely secure, especially if the potential hackers have physical access, but I want to know how much of a difference Command Prompt would make.

I assume that PowerShell and third-party programs like Git Bash would be about the same security-wise, but if there are significant differences, those would be helpful to know.

There's nothing you can do with cmd that you can't do with any other program, except run cmd. This will actually break some malware that specifically tries to invoke cmd without having fallbacks to other shells, but it will also break some legit software that uses functions such as system or otherwise spawns cmd processes. In general, cmd isn't a well-favored target for attack payloads - its scripting language is weak and a hassle to code for, and the much more capable powershell can now be expected on basically all Windows installs - but it is still the default shell and therefore some stuff will use it by default. If the attacker already has the ability to run arbitrary code other than cmd, the presence or absence ability to run cmd itself is mostly irrelevant.

If most software is blocked (even stuff that doesn't need admin) - that is, if software is whitelisted rather than blacklisted - then cmd might make a difference. It facilitates some moderately tricky things like creating symlinks, hardlinks, and junctions (via its mklink built-in), and its scripting language, awful though it is, is better than nothing in the case that powershell, WSH (cscript or wscript), and so on are blocked and so is running arbitrary downloaded, compiled, or remote executables. An attack that wanted to do something like that might fail if the system was sufficiently locked down. However, most of what cmd can do is somewhat redundant (and it can't actually do much). Since some other software (such as explorer, the Windows graphical shell) would presumably still be available, most basic shell operations (navigating the file system, copying/moving/deleting files, launching programs, setting file metadata, accessing environment variables, etc.) would probably be available without cmd, and similarly things like editing files would presumably be available through notepad or some other editor. Running command-line programs (such as reg, the command-line registry utility) doesn't require cmd; they can be invoked (with arbitrary arguments) from within explorer.

A user could download mIRC, and execute cmd with admin priviliges through a /dde command, for example.