win2k3 shutdown problems

I have a new win2k3 server.  After setup, I noticed all users had the shutdown option so I set GPO for administrator group only.  Now, the shutdown option doesn't display on the start menu, but the administrator doesn't have the shutdown option either!  How do I re-enable this option for administrator only?

(I made the change in: Admin Tools => Domain Security Policy => Local Policies => User Rights Assignments => Shutdown the system.  When this didn't work, I got desparate and also changed: ditto to DC Security Policy).

How bad is it? Do I have to re-install the OS?  Seems like I lost admin priviledges?

Thanks for any feedback on this.

Desparately Seeking Solution
aka Janice

Who is Participating?
John Gates, CISSPSecurity ProfessionalCommented:
Ok . If the machine is a domain controller is it stand alone or do you have other dcs?  Either way on the dc GPO enable shutdown of the system on the policy.

Then if you have more than one dc make sure you go into active directory sites and services and force a replication between all servers.

Then hopefully you have remote desktop enabled on the server.

If you do connect to the server and from a command prompt:

gpupdate /force

If you do not have RDP enabled then wait 15 - 20 mins and see if the shutdown value is enabled.  If it is not then:

right click my computer from your desktop machine > choose manage

right click the computer icon in the window that shows up and choose connect to another computer

then put the machine name in of your dc

right click again go to properties > advanced

click the settings button under startup and recovery and choose shutdown.

Then in the options that follow choose restart.

Let me know if this works out for you.


Go to that same localtion and verify the Administrators are listed. Do this in the DC Security Polcy.  That will filter down to all Domain Controllers in your orginization.

If you modified the Local Security Policy on the machine then you will need to go look there also and make sure that Administrators are listed.

If it is the DC Policy then make sure that Domain Admins is listed there.  If the local security policy then make sure that the LOCAL administrators group is there (Not just the local Administrator account).
Cloud Class® Course: Microsoft Office 2010

This course will introduce you to the interfaces and features of Microsoft Office 2010 Word, Excel, PowerPoint, Outlook, and Access. You will learn about the features that are shared between all products in the Office suite, as well as the new features that are product specific.

John Gates, CISSPSecurity ProfessionalCommented:
Still need further help with this?
zemarcAuthor Commented:
So far, I tried all the recommendations, but the 'shutdown' button is still gray'd out on the CNTRL-ALT-DEL window and not listed on the start menu.  I'm almost ready to do a manual shutdown, but am a little 'gunshy' because the one time I did shut the system down, it hung for hours (actually overnite) on 'checking settings' or something similar.


zemarcAuthor Commented:
Hello all,
I finally found the gpo setting I need.
It is under:

start => run => gpedit.msc
local computer policy
user configs
admin templates
start menu & task bar
remove & prevent access to the shutdown command

My shutdown button now shows again in my start menu (whew!)

Huge thanks to all.

p.s. this is a great site
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.