Networks

Ask something
Question Locked

Server 2003 AD - the Shutdown option is missing from users

0 helpful
20 replies

by levi_l

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I just recently installed a server 2003 domain and I started to add users and add the computers to the domain. I noticed that as I logged in with a standard user account, the option to shutdown was missing. I did some research on the net and found that there is a setting in the GP in an OU that should allow me to disable the function of disable and remove access to shutdown, but that feature wasn't even configured. I don't understand how it would automatically prevent users from shuttind down.
After lookin into it more, I have found that if I create a local account on a client machine and give that user administrative rights, then the shutdown option comes back. If I lower those rights to power user (or any other user account type) the shutdown, restart, and etc options go away again.

This is only happening on machines that are part of the domain, so my guess is that it has to do with the group policy.

Because I am new to the domain world, I have have some things configured incorrectly or something like that, so if you need some clarification, please let me know.

Also, I do not have roaming profiles enabled (if that helps) and I do not go to every machine and setup all of the users on the domain on that machine with a local account (that doesn't make sense to me), so if this is wrong, please let me know.

Thanks for your help!
Levi

20 replies

by Former member

By default a normal user only has log off username in the list of options when you hit shutdown from the start menu. Just so I don't have to search for this again:

Run Administraive Tools/Local Security Settings
Navigate to:
Security Settings/
Local Policies/
User Rights Assignment/

Add the user/group in question to "Shut down the system".

Please post back if you have any more problems or questions.

by levi_l

Peconet Tietokoneet,
That won't work because I would have to do it to every machine and I don't have that kind of time. This has to be a setting on the server.

by ic-it

It is best to remove that option from them, otherwise a percentage of them will think ok I'm done, shut er down.

You are correct in not adding users to the machine locally. When they logon to the domain on that machine they generate a profile.

by levi_l

My question is referring to not having shut down on the client workstation, not a server. People need to have the ability to restart their computers in the event of freeze-ups or for general cache clearing.

by dumphrey

you are saying that domain users, logged on to a domain workstation have no ability to shut down the local computer?

I would say your correct in thinking GPO.

In administrative tools, Select Group policy Management, and select each GPO you find under Group Policy objects, and select Settings. this will limit what you have to see to just configured options. This should help you locate where the shut down is being removed.

by levi_l

Dumphrey,
First I could not find GPM, but I realized that it wasn't installed on my machine and I had to download it from Microsoft.
After downloading it, I installed and started to browse all of the GPOs that are listed under the Domain. I disabled the feature called "Remove and Prevent Access to the Shutdown Command" on all of the GPOs listed.

I then went to a client computer, logged off, and logged back in and shutdown is still missing.

Any ideas?

by dumphrey

but glad you found it.

Gpupdate

run from the cmd line on a client workstation.

by jmantra

When you changed the group policy did you run the gpupdate command?

by levi_l

I did not run that command.
How would I do that?

by dumphrey

all it does is force immediate refresh of group policy.

At a comamnd line just type
gpupdate
On a client machine. Some GPOs effect immediately some on reboot. Check and see.
If its avaiable, all good, if not:
Reboot a workstation, log on to the domain and check, it should now allow you to power off the workstation.

by jmantra

Start>Run> type "cmd" then gpupdate in the command prompt

by levi_l

I open cmd and typed gpupdate
It said that Group Policy refresh has completed.
I also ran it on the client computer in cmd and it said "User policy update complete"

my guess is that it did do what it was supposed to do to update, but shutdown and restart options are still missing from the shutdown menu.

by dumphrey

how exactly did you set them, and what exact gpo setting were you looking at?

[edit]
found the same policy object under user\admin templates\ start menu and taskbar. looks like disabling should work, but try setting to not configures and then do gpupdate again.
But this time on the workstation do
gpupdate /force /boot
this will force a full gp update, not just what it thinks has changed and then reboot the computer, which will refresh the boot time options.

by levi_l

I changed the setting in the following location:
user config/admin templates/ start menu and task bar/ remove and prevent access to shutdown command

it was set to unconfigured, and I changed it to disable.

In reference to the 1st post, I did look at the local policy settings on the client machine and did find that the only groups allowed to "shutdown the system" are administrators, but it doesn't allow me to change that.

Any other ideas?

by dumphrey

policy then. How were you logged on to the local system? Log on to the machine as a local machine admin and you should be able to modify the local machine policy to allow everyone to poweroff.

EDIT:
Logged onto a domain workstation as a domain admin I was able to open an mmc and add a gpo snapin that pointed to the local machine (local machine policy). I then used the same policy object as in the gpo to remove the shutdown button. It was immediate, no gpupdate needed, no log out needed. When I set it back to unconfigured, the shutdown button came right back.
What policy object were you looking at that restricted it to Admin group only?

by levi_l

but I can't change that setting.

I never had this issue before adding the domain.
If I am logged in as administrator on the local machine, it still will not allow me to change the setting to add other groups.

edit:
I noticed the icon next to the policy on the local machine. It's different that the other ones. I can change most of the policies listed, but the ones that have that icon next to them, will not allow me to change them.
My guess is that, that policy is being created or controlled by the domain server.

by levi_l

You change it in the GPO in the following location in the either using mmc snap in on the client machine or using the server:
computer config/ windows settings/ security settings/ local policies/ user rights and assignments

in there, you can modify local user rights on client machines.
That is where the "shut down the system" policy is located and that is where you can modify the setting to make it so users can shut down their machines.

This discussion is closed to new replies.