Solved

Windows 2008R2 Terminal Services Server - Logoff vs shutdown

Posted on 2014-10-15
3
305 Views
Last Modified: 2014-10-16
This is a two-fold question.   Our Windows 2008R2 Terminal Server was shutdown remotely yesterday.  I need to know how to remove the "shut down" option from the dropdown menu that is adjecent to the <Logoff> button while in a RDP session.  In other words, I believe one my remote users clicked the small down arrow next to the <Log Off> button which displayed a dropdown menu and they selected "Shut Down"...I need to know how to eliminate the "shut down" option from the dropdown menu.

And secondly, is there an easy way either via the logs or some other fashion to determine which user shut down the TS Server?

Thank you in advance for your reply...I appreciate any comments.
0
Comment
Question by:infosys3
3 Comments
 
LVL 13

Assisted Solution

by:akb
akb earned 250 total points
ID: 40383601
By default regular users do not have a Shutdown option in RDP. I suspect the are in the Administrator group where they could do a lot of damage.
I'm not sure about the logs. You should have a look in Event Viewer at the logs immediately prior to the shutdown.
0
 
LVL 7

Accepted Solution

by:
Stampel earned 250 total points
ID: 40383850
In the windows eventviewer you can find this in the log security and stuff.
(Launch it with command "eventvwr" from start menu)
In the system log you will see if the shutdown was regular (by a user) or forced (power issue / hang ..). You will have to look arround the datetime of the reboot.
Looking at the file "pagefile.sys" you can find the datetime of this reboot easily.
0
 

Author Closing Comment

by:infosys3
ID: 40384966
Thank you gentlemen for your timely response.  As it turned out MS automatic security updates which happened at 3:30am required a reboot.  Unknowningly, I immediately took this situation as user issue.  I am splitting the 500 points between the both of you.

akb:  I have checked all user accounts and I have a handle on who in in the administrator group.  Thanks.

Stampel:  After searching diligently in the event viewer I found an event where a restart is required to complete the installation of the updates.

Thank you both again for your help.  I appreciate it.
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now