prevent members of administrators group


  • Hi, our security groups is a member of local administrators on all servers, we want to prevent them from restarting or shutting down any servers. it would be ideal if all they say was logoff when they were on a server.

    if we define this group in a GP and configure Remove and prevent access to the shutdown, restart, sleep, and hibernate commands, will this also restrict the users on their desktops as well as servers?



    Monday, September 14, 2015 6:53 PM

All replies

  • Hello,

    if they are local admins they can revert any setting you configure with GPO locally on the machine until the next automatic GPO refresh occurs.

    So in your case either don't make them admin or trust them about there work.

    Best regards

    Meinolf Weber


    Microsoft MVP - Directory Services

    My Blog:

    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.


    Monday, September 14, 2015 7:01 PM
  • we do not have a choice, we have been mandated by management o give them local admin access. the users are the ones who are worried about accidentally reststarting or shutting down servers so we would like them to not even see that option

    Tuesday, September 22, 2015 2:01 PM