Giving local user access to psshutdown from SysInternals

[roberto]

Running a W2K3 domain with mostly W2KPro clients.

Want to remove user access to the "Shutdown" button via Group Policy to
enforce leaving machines on for off hour patching, defragging,
scanning, etc. Removing "Shutdown," of course, also removes access to
"Restart" - bummer.

We need a way to give users a means to reboot their box in the event it
gets hung for whatever reason. I would like to put a PsShutdown icon
in their start menus or on their desktops. In trying this, I find that
users do not have rights to run that app - even though I have applied
appropriate permissions and have included the app's name in the Policy
that limits acceptable apps in the domain.

How can I go about giving unprivileged uses a pre-configured (with
appropriate switches already applied)icon for PsShutdown.exe?

I can use the Shutdown.exe utility available in the W2K resource kit -
but it doesn't seem to lend itself to being pre-configured for a forced
reboot in xx seconds with a message of "Yadaa yadaa yaddaa." It also
allows users to browse for and shutdown other machines remotely unless
the appropriate policy setting is configured.

Thanks

roberto

 

[Bruce Sanderson]

Using a "run as" utility such as the free one from PalmerSoft
(http://www.palmersoft.co.uk/Runasuser.htm), you can create a command file
that has exactly the command you want in it, then package it into an
executable specifying the security context you want to use.

You could create a command file with the shutdown -r command and package it
to run with, for example, the local Administrator user account. The
username and password are buried in the executable, so the users won't see
it or need to know it.