Remove Shutdown from Remote Desktop Connections

i read this article: http://support.microsoft.com/default.aspx?scid=kb;en-us;313924&sd=tech
and used it as a basis for removing the shutdown button from the start menu for those who connect to our server with RDP.

in the first section of the article, it said to go to gpedit.msc and go to the security options.  make sure "allow system to be shut down without having to log on" should be disabled.  this was already disabled, and yet there was a shutdown button on everyone's RDP start menu.

so the article said that the domain-wide policy may override the local policy settings.  i followed the instructions which said to go to the default domain policy (which is the only domain policy we have) and enable "disable and remove the shutdown command"

this removed the shutdown button from the start menu on RDP sessions... BUT it also removed the button from the start menu on the client computers which are joined to the domain (not using RDP).

how to i configure it so that the shutdown button is only removed for those who connect with RDP?  i do not want to take away the option from the client computers joined to the domain.

thanks
LVL 44
zephyr_hex (Megan)DeveloperAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jay_Jay70Commented:
Hi zephyr_hex,

we found the easiest way was to to create term serv users in a different OU and apply the policy to them

Cheers!
zephyr_hex (Megan)DeveloperAuthor Commented:
Jay Jay-
what is OU ?  (sorry to have my newbieness showing)
Jay_Jay70Commented:
an OU is an organisational unit in Active Directory - do you have admin access to AD?
Acronis True Image 2019 just released!

Create a reliable backup. Make sure you always have dependable copies of your data so you can restore your entire system or individual files.

zephyr_hex (Megan)DeveloperAuthor Commented:
yes, i have access to AD

i was not involved in the original setup of AD.  but i have been handling it for the past 6mos.  in that time, i have added 2 "OU's" for new braches we've opened.  the bulk of the users are in their original "folder" (which is not an OU...but i'm not sure how to identify what kind of folder it is).

so i should create more OU's...and move the users out of their folder into the OU's... and then work with group policies for each OU so that all the remote users will have the shutdown button removed.  does this sound right?  if so... i have one other question.. there is only 1 group policy (at the domain level).  one of the OU's i created a few months ago has the "default domain policy" showing under the group policy tab.  the other OU i created does not have it. how do i get the default domain policy to show under the group policy tab?

thanks
Jay_Jay70Commented:
that is correct - you should be dividing AD up with OU's for departments etc, and then applying group policy like you said :)

the default domain policy applies to all, you may have lost the link to it, but first check, does the policy apply? - remember it is best practice to not edit that default domain policy also

policies also apply like this
LSDOU
which means   local   Site   Domain  OU     last policy applied wins, so be careful of creating conflicting policies

here is a really usefull reference for you when working with GPO
http://www.microsoft.com/downloads/details.aspx?FamilyID=7821C32F-DA15-438D-8E48-45915CD2BC14&displaylang=en

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
zephyr_hex (Megan)DeveloperAuthor Commented:
thanks.
i will set things up as you've explained... and change the default domain policy back to allowing the shutdown button on the start menu... and instead edit the group policy
Jay_Jay70Commented:
good work, if you get stuck give me a yell
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.