Disabling CMD and BIOS for non admin accounts Domain

Hello dear people of Tenforums. ive used this site everyday since i started my job as head of IT in the local goverment office i work. and i have learned alot like making a new DC

Anyways to the point.

The systems implemented in the 4 schools of the local goverment are old and lacking. they ran on a win 2003 server with users dating back to 2004. instead of cleaning it up i set up a new DC with server 2016.

After spending some times in the school i found pc's riddled with gaming software and pop up's (viruses).
i reinstalled 97 pc's so far this summer and implemented anti viruses.

im here to ask for help doing something else tho. I want to restrict access to CMD and BIOS. most of the time i read about Group policy blocking cmd. but this would be tedious as all pc's will be configured for remote access to remotely help them. having to then logg onto admin acc and disable the policy would make it impossible to remote fix pc's. some of the schools are rather far away from my IT office as well.

Id like to set it up so if you try and start cmd it will ask for admin credentials either from the local pc or the domain admin account. is there a way to do that?

i would also like to block access to BIOS as these children "explore" everything they can.

Blocking access to the BIOS rather simple, but I'm telling you right now, unfortunately you're going to need to go through every single one of those computers again. You need to set an Admin password inside the BIOS itself. The location/name will change depending on the brand, model and age of the computer so I cant really tell you exactly but it tends to look like this (this is the VMWare bios, here it's called Supervisor).



As for the CMD, Group Policy is really the simplest solution. Instead of straight up blocking it, I'm sure there's a way to make a policy that does exactly what you're wanting, to ask for credentials every time it starts (don't have access to an AD as I'm writing this so I can't exactly guide you right now), although it's probably slightly less of a concern as regular users already don't have the permissions to run it as admin (a lot of commands will return a failure when ran as user as well).