none
After Disabling Shutdown/Restart through GPO, shutdown.exe no longer works

    Question

  • After disabling the Shutdown/Restart/Sleep option in Group Policy, User Config > Policies > Administrative Templates > Start Menu and Taskbar > Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands, users are now unable to use shutdown at a command prompt.  They receive an Access Denied 5 error.  I wanted to disable just Shutdown, but as this is impossible, and restarting is sometimes neccessary for various reasons, I wanted to add a shortcut to their desktops that would allow for restarting.  In testing, I found that the shutdown.exe way of restarting is being blocked.  Everything I have read indicates that this should not be blocking the shutdown command.  After reversing the Group Policy, shutdown works normally.  Any ideas why this is happening?  Any help is appreciated.
    Wednesday, October 7, 2015 3:37 PM

Answers

  • Hi,
     
    I have just tested this in my loal lab, after configuring "Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands" policy setting, I'm able to restart my workstation by running "shutdown -r -f -t 0" from an elevated command prompt.
     
    Can you please make sure the test user account is a member of the Administrators group on the machine, then try again? It seems to me that the process was initiated by a user who does not have full administrative access.
     
    Hope this hleps.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Monday, October 12, 2015 8:33 AM
    Moderator

All replies

  • Hello,

    This is an old problem folks have been trying to work their way around. You can see an old forum thread for this

    https://social.technet.microsoft.com/Forums/windowsserver/en-US/5054f70b-5376-4723-b8dc-6bc2627be86e/disable-shutdown-but-allow-restart?forum=winserverGP


    If you find this helpful, kindly mark as answer. If you have any queries, please post back as a reply. Will look forward to your feedback. Thanking You Soumyajyoti Biswas

    Wednesday, October 7, 2015 3:50 PM
  • Did you try "shutdown -r -f -t 0" without quotes

    Rajeev Sharma CCNA, MCSE, VCP4 http://www.gotzu.com

    Wednesday, October 7, 2015 3:54 PM
  • Yes, it gives me an 'Access Denied 5' error.
    Wednesday, October 7, 2015 8:58 PM
  • I saw that thread earlier, and in it several people say that doing this will not disable the shutdown.exe command, but it actually does.  I think I may use a registry edit, that will hide all the buttons, but still leave the shutdown.exe enabled.  Thanks for your help.

    Wednesday, October 7, 2015 9:00 PM
  • Hi,
     
    I have just tested this in my loal lab, after configuring "Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands" policy setting, I'm able to restart my workstation by running "shutdown -r -f -t 0" from an elevated command prompt.
     
    Can you please make sure the test user account is a member of the Administrators group on the machine, then try again? It seems to me that the process was initiated by a user who does not have full administrative access.
     
    Hope this hleps.
     

    Regards,

    Ethan Hua


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Monday, October 12, 2015 8:33 AM
    Moderator