Disable the Command Prompt

I have a NT 4.0 Domain and WIN2K running on the workstations. The users are students that continually challenge me. They are going in through the command prompt by creating a shortcut to it and then running commands. I cannot change the name of it, I cannot change permissions because some applications need it. How can I hide it so they cannot find it?