REMOVE SHUTDOWN FROM ALL BUT ADMIN ON TERMINAL SERVER

I have a Terminal Server in Application mode.  I am concerned about users accidentally shutting the Terminal Server down using the SHUTDOWN command from the START MENU.  I used Group Policy to add a LOGOFF button, but am considering two courses.

1)  Can I remove the SHUTDOWN option from the START menu, but still allow a user to restart the without it being so obvious.

2)  Or could I change the server so that only Administrators can shutdown or restart the server.

Are these possible, and if so, how do I do it.

Thanks for any help.

Steve
LVL 8
smeekAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

MirfsterCommented:
How to remove shutdown menu from Start:

To remove shutdown menu and keep Logoff, go to MMC>Local Group Policy>User Configuration>Administrative Templates\Start Menu and Taskbar to enable Disable and Remove Shut Down Command and add Logoff.

http://www25.brinkster.com/ChicagoTech/shutdown.htm#How%20to%20remove%20shutdown%20menu%20from%20Start
smeekAuthor Commented:
Forgot to metion that I did that and then neither users nor the Administrator could restart the machine.  Was funny when my level 1 guy walked up to me apologetically and said he couldn't restart the server...  But I need Admin to be able.

Steve
MirfsterCommented:
Also, this may help:

In w2k/xp How do I prevent "Shutdown/restart" for non-admins?:
https://lists.aas.duke.edu/pipermail/ntgroup/2003-February/001107.html

Local Computer Policy --> User Configuration --> Administrative
Templates --> Start Menu and Taskbar --> Remove and Prevent Access to
the Shut Down command:  

"Prevents users from shutting down or restarting Windows.
This setting removes the Shut Down option from the Start menu and
disables the Shut Down button on the Windows Security dialog box, which
appears when you press CTRL+ALT+DEL.
This setting prevents users from using the Windows user interface to
shut down the system, although it does not prevent them from running
programs that shut down Windows.
If you disable this setting or do not configure it, the Shut Down menu
option appears, and the Shut Down button is enabled.
Note: It is a requirement for third-party applications with Windows 2000
or later certification to adhere to this setting."

AND

Remove and disable the Turn Off Computer Button:

"If you enable this setting, the "Turn Off Computer" button is removed
from the simple Start Menu and the user is prevented from turning off
Windows using the standard shutdown user interface.
If you disable this setting or do not configure it, the "Turn off
Computer" button remains on the simple Start menu."

More is available here:

    http://support.microsoft.com/?kbid=313924
The 7 Worst Nightmares of a Sysadmin

Fear not! To defend your business’ IT systems we’re going to shine a light on the seven most sinister terrors that haunt sysadmins. That way you can be sure there’s nothing in your stack waiting to go bump in the night.

smeekAuthor Commented:
I tried to use a third party shutdown app that I have used before ad told it to force restart, but I did not seem to work.

Steve
MirfsterCommented:
If the doesn't work, you can use "restart" the Server remotely using:

How to shutdown a  Win2000/XP remotely

To remote shutdown windows 2000/XP, 1) run MMC>Computer Management; right-click Computer Management (local)>connect to another computer; select the remote computer; right-click Computer Management (remote computer)>Properties>Advanced>startup & Recovery>shutdown. 2) use command shutdown \\computername. Note: The specified computer may not shut down when you use the Shutdown.exe tool to shut it down. This behavior can occur if the Unlock Computer dialog box appears on the desktop, or if the computer is locked. 3) Other remote access software such as Terminal Service, pcAnywhere, Netmeeting, VNC and Telnet. 4) Use Shutgui.exe from NT Resource Kit

or

You can use the "Shutdown.exe: Remote Shutdown (Shuts down or reboots a local or remote computer.) from the 2000 Resource Kit.  (If you have it).

or

CrazyOne has some nice utils that you can check out: http://www.geocities.com/eecrazyone/crazyone.html
      Thanks CrazyOne, if I get points for this, I'll send some your way....  :)

or

"PsShutdown" from Sysinternals (Free) from: http://www.sysinternals.com/ntw2k/freeware/psshutdown.shtml
I would suggest downloading the "PSTools" Suite.. Nice stuff all free..


 
MirfsterCommented:
<<I tried to use a third party shutdown app that I have used before ad told it to force restart, but I did not seem to work.>>

What was the util?
smeekAuthor Commented:
Shutdown Timer, from Blank Penguin software.  GUI shutdown with timer.  Use it when I want to do a late night restart or after a period of time.

I guesss my pref would be to disable the command for all users except Admin.  I would rather not have to resort to utilities for a simple restart (unless that is my only option).

Steve
chaddupuisCommented:
The trick is to creat a Group Policy Object, In this object disable the Shutdown feature. Now you may have done this but it was applied to the 'users' or 'domain users' groups and this will disable it for everyone. What you need to do is create a seperate organizational unit or group for everyone except the admins, and apply this security policy to that group or OU.
Anthony MolinaIT TECHNICIAN / CONSULTANTCommented:
Customiser XP is another that allows scheduled shutdowns as well as other UI Tweaks.
Can any of you guys  identify a CMD command that shuts down the server? if you do you could create  a shutdown.cmd file to run from task scheduler . just a thought..
chaddupuisCommented:
please view the original post, the user is asking how he can remove the ability from users to accidentally shut the server down. The proper way to do this is through group policy and that is that. All the other suggestions have been band aids to the problem.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
MirfsterCommented:
smeek,

    Did you try the suggestion in my second comment?
compaqenCommented:
Comment from Mirfster
Date: 08/26/2003 07:09PM PDT

I edited the local user policy on our three Windows Terminal Servers, as detailed above, it worked and my users can no longer shutdown or restart the servers.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 2000

From novice to tech pro — start learning today.