On computers running a Pro version of Windows, administrators can use a Group Policy rule to specify system components that are not allowed to start. Such a restriction is useful, for example, when a less experienced user is assigned to the machine.
In the search box, type: gpedit.msc and hit enter to open the Local Group Policy Editor. In the left column, go to the User Configuration / Administrative Templates / System folder and in the right pane, double-click Do not run the specified Windows applications.
First turn it on by clicking on the Enabled button above, then click on the Display… button to open the Display Content window. Here we can specify which applications the user cannot launch.
For example, to completely disable Command Prompt, Windows Power Shell, and Disk Management, type cmd.exe, powershell.exe and diskmgmt.msc and save by clicking OK.