Can we prevent command prompt access on all servers except for when run by a domain administrator?