Preventing the execution of MS-DOS comma

Hi every body …

How can I stop users from running MS-DOS commands on their Windows 2000 stations?

I have already used the policy editor to disale the command prompt and to remove the Run option from the start menu.

Unfortunately its stillpossible for the users to create a batch file , place whatever commands ( particularly the net command ) they need and then execute the batch file itself.

I have also added the net.exe & cmd.exe to the restricted applications using the policy editor but they can still be run.

Thanks & best regards.