Solved

Windows 2008R2 Terminal Services Server - Logoff vs shutdown

Posted on 2014-10-15
3
310 Views
Last Modified: 2014-10-16
This is a two-fold question.   Our Windows 2008R2 Terminal Server was shutdown remotely yesterday.  I need to know how to remove the "shut down" option from the dropdown menu that is adjecent to the <Logoff> button while in a RDP session.  In other words, I believe one my remote users clicked the small down arrow next to the <Log Off> button which displayed a dropdown menu and they selected "Shut Down"...I need to know how to eliminate the "shut down" option from the dropdown menu.

And secondly, is there an easy way either via the logs or some other fashion to determine which user shut down the TS Server?

Thank you in advance for your reply...I appreciate any comments.
0
Comment
Question by:infosys3
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
3 Comments
 
LVL 13

Assisted Solution

by:akb
akb earned 250 total points
ID: 40383601
By default regular users do not have a Shutdown option in RDP. I suspect the are in the Administrator group where they could do a lot of damage.
I'm not sure about the logs. You should have a look in Event Viewer at the logs immediately prior to the shutdown.
0
 
LVL 7

Accepted Solution

by:
Stampel earned 250 total points
ID: 40383850
In the windows eventviewer you can find this in the log security and stuff.
(Launch it with command "eventvwr" from start menu)
In the system log you will see if the shutdown was regular (by a user) or forced (power issue / hang ..). You will have to look arround the datetime of the reboot.
Looking at the file "pagefile.sys" you can find the datetime of this reboot easily.
0
 

Author Closing Comment

by:infosys3
ID: 40384966
Thank you gentlemen for your timely response.  As it turned out MS automatic security updates which happened at 3:30am required a reboot.  Unknowningly, I immediately took this situation as user issue.  I am splitting the 500 points between the both of you.

akb:  I have checked all user accounts and I have a handle on who in in the administrator group.  Thanks.

Stampel:  After searching diligently in the event viewer I found an event where a restart is required to complete the installation of the updates.

Thank you both again for your help.  I appreciate it.
0

Featured Post

Turn your laptop into a mobile console!

The CV211 Laptop USB Console Adapter provides a direct Laptop-to-Computer connection for fast and easy remote desktop access with no software to install.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Background Information Recently I have fixed file server permission issues for one of my client. The client has 1800 users and one Windows Server 2008 R2 domain joined file server with 12 TB of data, 250+ shared folders and the folder structure i…
This article explains how to install and use the NTBackup utility that comes with Windows Server.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

622 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question