Logoff missing, Shutdown button displayed

[Raymond]

Help.
I have an issue with a Windows 2000 SP4 server running
terminal services with 5 wyse terminals. Recently the
server was infected with the Backdoor.irc.tastyred and
W32.Randex.F virus, which have since been removed. Now
there is an issue, one of the 5 wyse terminal users will
have the Shutdown button shown, all the others will show
the Logoff button. It looks like either the last user to
login has this issue or its related to a specific user,
I'm still testing this out to see which scenario applies.
All users are members of the Server Operator's group.
When remove from the Server Operator's group, users can't
login due to the following error "The Local Policy of
This System Does Not Permit You to Log on Interactively.
I was hoping that if I removed the users from the Server
Operator's group that the Shutdown Button issue would be
resolved as users wouldn't have sufficient rights. I
think its a policy or rights issue but I'm not sure what
to look for. The only other option I can think of is to
reapply SP4, but I really don't think that will resolve
this issue.

Any help would be greatly appreciated.

 

[Matthew Harris [MVP]]

Yeah, redoing SP4 probably won't do anything, but it might
be nice to do it since you've had some virus troubles.

Regardless, the logon problem you have is most likely due
to your users not having the logon on locally right. Give
that to them and you should be good.

Also, I would double check your group policies to make
sure that you have the policy setup to remove the shutdown
button and only leave the logoff button.

-M