restrict access to cmd