I've worked with a client that blocks cmd, but not Powershell or VBA. God, I hate security-by-explicit-requirement.