removing shutdown command

[Guest]

Hi

On a Windows 2003 terminal server, a remote client can shutdown the server
by selecting start and shutdown.

How do i remove the shutdown command from the remote users menu or deny the
user this capability?

Mny thanks

Nick

 

[mculver]

Modify the Group Policy object that the users are assigned to to Remove
Shut Down from the Start Menu under User Configuration, Administrative
Templates, Start Menu and Taskbar. You will see the option for it,
there.

 

[Vera Noest [MVP]]

If your users can shutdown the Terminal Server, they are members of
the Administrator group.
If that's the case, there is no way to prevent them from shutting
down the server (and they will be able to do far more serious
damage than merely shutting it down!).

You can remove the Shutdown option from the Start Menu with a Group
Policy, but this is only a cosmetic change. Normal users will *not*
be able to actually shutdown the server, even if they see the
option, and Administrators *will* be able to shutdown the server,
even if they don't see the option.

 

[mculver]

Not true. If you really want to restrict the access to shut down the
system, open up the group policy object that is assigned to the server.
Under Computer Configuration, Windows Settings, Security Settings,
Local Policies, and User Rights Assignment, you will see a setting to
"Shut Down the Server". You can grant/revoke the privilege, there.

 

[Vera Noest [MVP]]

But chances are, if normal users are Administrators, they will be
able to change the policy back again.
And now we are only talking about using the shutdown command....
There is *no* defence against Administrators.

 

[mculver]

You do not have to be an Administrator to shut down a machine, and yes,
if they are Administrators they will be able to set the GP back to
allow them to shut down the machine. However, if their right to shut
down the machine is revoked in Group Policy, they will not be able to
issue any command to shut down the server. I think that you should
probably review security under Windows 2000/2003.

 

[mculver]

You do not have to be an Administrator to shut down a machine, and yes,
if they are Administrators they will be able to set the GP back to
allow them to shut down the machine. However, if their right to shut
down the machine is revoked in Group Policy, they will not be able to
issue any command to shut down the server. I think that you should
probably review security under Windows 2000/2003.