If creating a policy package for SCCM: Compile to EXE, add the EXE you just created to SCCM as a package: Create Package > Environment > Program can run: Only when user is logged on > Run with user rights.
Registry
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System
type: dword
value: DisableCMD
data: 2