This is a two-fold question. Our Windows 2008R2 Terminal Server was shutdown remotely yesterday. I need to know how to remove the "shut down" option from the dropdown menu that is adjecent to the <Logoff> button while in a RDP session. In other words, I believe one my remote users clicked the small down arrow next to the <Log Off> button which displayed a dropdown menu and they selected "Shut Down"...I need to know how to eliminate the "shut down" option from the dropdown menu.
And secondly, is there an easy way either via the logs or some other fashion to determine which user shut down the TS Server?
Thank you in advance for your reply...I appreciate any comments.