A good way of restricting access to cmd.exe can be your access control lists.In other way you can move your system critical apps to a new dir and restrict the access of this dir to only specific users.And also this new directory should'nt be in your PATH variable.
Bye DRajesh
