Announcement

Collapse
No announcement yet.

Terminal Server - hide shut down button

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Terminal Server - hide shut down button

    I have a Windows Server 2003 Terminal Server installed on an SBS 2003 network as a member server. I want to hide the shut down buttom for remote users.

    I did not use a Group Policy because I only want to hide the shutdown button on this server. Is that possible?

    I ran the local policy editor and 'Shutdown: Allow system to be shut down without having to log on' is already DISABLED.

    Suggestions?

    Thanks
    Network Engineers do IT under the desk

  • #2
    Re: Terminal Server - hide shut down button

    AFAIK, this can only be done through a GPO or through the registry. The setting you referenced is a user right and has no bearing on the interface (the shutdown button being visible on the start menu). What your setting actually does is makes the shutdown button unavailable when at the press CTL + ALT + DEL prompt.

    Comment


    • #3
      Re: Terminal Server - hide shut down button

      JoeQwerty is correct that this setting should be controlled via a GPO but if you want to do it manually, log onto the TS server, click on Start\Administrative Tools\Local Security Settings. Click on Local policies\User Rights Assignment and look for the setting "Shut down the system". You should have:
      • Admiinstrators
      • Power Users
      • Backup Operators

      Members of these groups will have the option to shutdown the TS server. Other users will see Disconnect button in the Start menu as opposed to the Shutdown button.
      |
      +-- JDMils
      |
      +-- Regional Systems Engineer, DotNet programmer & Jack of all trades
      |

      Comment


      • #4
        Re: Terminal Server - hide shut down button

        I thought by default standard users cannot shutdown TS's anyway.?
        Please remember to leave positive reputation points (The Ying Yang Icon) if someone helps you.

        Comment


        • #5
          Re: Terminal Server - hide shut down button

          I logged on to the Terminal Server as one of the 'standard' remote users and they have the 'shut down' button on their desktop. I also checked the User Rights Assignment on the TS an only the members you describe below are listed as able to shut down the system, however, this is not the case.

          I'm stumped!

          Originally posted by JDMils View Post
          JoeQwerty is correct that this setting should be controlled via a GPO but if you want to do it manually, log onto the TS server, click on Start\Administrative Tools\Local Security Settings. Click on Local policies\User Rights Assignment and look for the setting "Shut down the system". You should have:
          • Admiinstrators
          • Power Users
          • Backup Operators

          Members of these groups will have the option to shutdown the TS server. Other users will see Disconnect button in the Start menu as opposed to the Shutdown button.
          Network Engineers do IT under the desk

          Comment


          • #6
            Re: Terminal Server - hide shut down button

            What specifically do you mean by "on their desktop"?
            cheers
            Andy

            Please read this before you post:


            Quis custodiet ipsos custodes?

            Comment


            • #7
              Re: Terminal Server - hide shut down button

              Well this can be done by editing the registry.

              HCU\Software\Microsoft\Windows\CurrentVersion\Poli cies\Explorer

              New Dword= NoClose

              Value= 1
              [Powershell]
              Start-DayDream
              Set-Location Malibu Beach
              Get-Drink
              Lay-Back
              Start-Sleep
              ....
              Wake-Up!
              Resume-Service
              Write-Warning
              [/Powershell]

              BLOG: Therealshrimp.blogspot.com

              Comment


              • #8
                Re: Terminal Server - hide shut down button

                Originally posted by AndyJG247 View Post
                What specifically do you mean by "on their desktop"?
                When you click the start button, you have an icon to log off and an icon to shut down the computer.

                I was able to find a solution in the local policy by doing a little exploring.

                User Configuration - Administrative Templates - Start Menus and TAskbar - Remove and prevent access to the shutdown command {enabled}

                PROBLEM SOLVED.
                Network Engineers do IT under the desk

                Comment


                • #9
                  Re: Terminal Server - hide shut down button

                  Originally posted by Killerbe View Post
                  Well this can be done by editing the registry.

                  HCU\Software\Microsoft\Windows\CurrentVersion\Poli cies\Explorer

                  New Dword= NoClose

                  Value= 1
                  That was a key in Windows 2000 I was reluctant to add it in Server 2003. My solution was in User Configuration - Administrative Templates - Start Menu and Taskbar

                  Thanks
                  Network Engineers do IT under the desk

                  Comment


                  • #10
                    Re: Terminal Server - hide shut down button

                    Glad you fixed it.
                    The question was just to make sure you didn't mean there was an icon actually ON the desktop as such as some utilities can add shutdown/restart etc shortcuts and these woudln't be affected by group policy (well removing them wouldn't)
                    cheers
                    Andy

                    Please read this before you post:


                    Quis custodiet ipsos custodes?

                    Comment


                    • #11
                      Re: Terminal Server - hide shut down button

                      Originally posted by AndyJG247 View Post
                      Glad you fixed it.
                      The question was just to make sure you didn't mean there was an icon actually ON the desktop as such as some utilities can add shutdown/restart etc shortcuts and these woudln't be affected by group policy (well removing them wouldn't)
                      Ya, poor choice of words in my description
                      Network Engineers do IT under the desk

                      Comment


                      • #12
                        Re: Terminal Server - hide shut down button

                        Originally posted by RobW View Post
                        That was a key in Windows 2000 I was reluctant to add it in Server 2003. My solution was in User Configuration - Administrative Templates - Start Menu and Taskbar

                        Thanks
                        It works for 2003 also.
                        And yes it is available through GPO and local policies.
                        [Powershell]
                        Start-DayDream
                        Set-Location Malibu Beach
                        Get-Drink
                        Lay-Back
                        Start-Sleep
                        ....
                        Wake-Up!
                        Resume-Service
                        Write-Warning
                        [/Powershell]

                        BLOG: Therealshrimp.blogspot.com

                        Comment


                        • #13
                          Re: Terminal Server - hide shut down button

                          For the record, if a standard user has permissions to shutdown the TS server, then you have a rights problem on that server. You may have solved the issue by hiding the button, but they can still issue a Shutdown.exe in a cmd box, which they should not have the ability to do.

                          Create a new user and make sure the only membership he has is to log onto the TS server. Is the Shutdown command still there for the user? Check the TS server's local group memberships (if available) to make sure users are not in the admins group.

                          For my peace of mind, I'd like to know what you find.
                          |
                          +-- JDMils
                          |
                          +-- Regional Systems Engineer, DotNet programmer & Jack of all trades
                          |

                          Comment


                          • #14
                            Re: Terminal Server - hide shut down button

                            I initially looked at a GPO but that would have removed the shutdown button on all the servers, not something I wished to do.

                            I found this limitation could be overcome by putting the TS in a different OU but this was starting to become a complicated process for such a minor task - hiding a button.
                            Network Engineers do IT under the desk

                            Comment


                            • #15
                              Re: Terminal Server - hide shut down button

                              The users created on the Small Business Server domain have no special group created for the terminal server. I have implicitly denied all users the ability to log on to a terminal server in their user profile with the exception of three users.

                              These three users, the terminal server users, are domain users only and not members of the TS local administrator group.

                              I am not concerned if the shutdown command is available. I am trying to eliminate a clerical user from accidently shutting down the server when they log out of a TS session.

                              Thanks

                              Originally posted by JDMils View Post
                              For the record, if a standard user has permissions to shutdown the TS server, then you have a rights problem on that server. You may have solved the issue by hiding the button, but they can still issue a Shutdown.exe in a cmd box, which they should not have the ability to do.

                              Create a new user and make sure the only membership he has is to log onto the TS server. Is the Shutdown command still there for the user? Check the TS server's local group memberships (if available) to make sure users are not in the admins group.

                              For my peace of mind, I'd like to know what you find.
                              Network Engineers do IT under the desk

                              Comment

                              Working...
                              X