1

I manage a group of about 40 users. I have continually asked them not to shut their computers down, ever - plan and simple; however, there are quite a few that still do, regardless of what I say. Primarily because there are a couple of managers that still tell them to - I suppose because they know better than me!

This is really inconvenient when trying to work remotely only to be unable to connect. That being said, I know there is a way to disallow this via group policy; however, I am not sure all of the GP settings that need to be configured to facilitate this.

I do not want them to have the ability to shutdown via the start menu, or logon screen. Nor do I want them to be able to press the button and turn it off. These are all desktops with no batteries.

I do want them to have the ability to restart though still. The majority are Windows 7 machines and I have some XP machines - I understand there are differences between the GP for each of these OSs.

Finally, when I do this, I will be able to shutdown if needed still though, using the command prompt right? Thanks!

Mike

8 Spice ups
2

Hello,

You are able to disable it in that way: create a group and join the users and then create a GPO: User computer - Administrative template - Start Menu and Taskbar:

ScreenShot167.jpg
ScreenShot167.jpg861×465 65.8 KB
3

Take a look at

User Configuration / Policies / Administrative Templates / Start Menu and Taskbar / Remove and prevent access to the Shutdown, Restart and Sleep commands.

4

You can shut down by typing

shutdown

(with -r after to reboot)

(-t:xx to specify time in seconds to reboot.)

e.g. shutdown -r -t:40

HTH

Mick

5

http://dave.harris.net/post/2010/07/27/Remove-shutdown-but-allow-restart-via-Group-Policy.aspx

This looks like something that would work for you. I looked through it and it seems like a pretty good step by step that removes the option to shut down, but still allows for some flexibility to restart.

Hope this helped.

6

BTW, this seemed to work with Windows 7. If you don’t know how to make a batch file, just let me know and I can help you with that too.

7

Mick2404 wrote:

You can shut down by typing

shutdown

(with -r after to reboot)

(-t:xx to specify time in seconds to reboot.)

e.g. shutdown -r -t:40

HTH

Mick

I think OP was looking for a way for the users to NOT do this. :slight_smile: -

—update—ah, just reread the post in full detail, my bad!—

In any case, Mick brings up a good point. You may have a savvy user somewhere that might try to run this.

Also, the user might just power the computer off out of frustration.

8

We actually remove the run command, the shutdown button, and also the ability to browse to the C: and D: drives on our users logon’s… :slight_smile: ahhhh the power… lol

9

@Jose - thanks for the screen shot. I should have mentioned that I am on Server 2008. The option that you are displaying no longer exists in that form - now it includes Remove and prevent access to the Shutdown, Restart and Sleep commands.

@Mbrown - awesome - that looks like a good solution for me. I do know how to create a batch file; but I am unsure how to place the icon that he is referring to and the batch file onto the machines using GP. I could use some help with that.

@Rob - when you are saying that the user might just power the computer off out of frustration, did you mean with the power button? If so, I think GP handles that also -

There is a policy: Computer Configuration | Administrative Template | System | Power Management | Button Settings | Select the Power Button Action (plugged in).

I can set this to do nothing, which essentially means they have no way of shutting the computer down at all.

Thanks!

10

acs-mike wrote:

@Jose - thanks for the screen shot. I should have mentioned that I am on Server 2008. The option that you are displaying no longer exists in that form - now it includes Remove and prevent access to the Shutdown, Restart and Sleep commands.

@Mbrown - awesome - that looks like a good solution for me. I do know how to create a batch file; but I am unsure how to place the icon that he is referring to and the batch file onto the machines using GP. I could use some help with that.

@Rob - when you are saying that the user might just power the computer off out of frustration, did you mean with the power button? If so, I think GP handles that also -

There is a policy: Computer Configuration | Administrative Template | System | Power Management | Button Settings | Select the Power Button Action (plugged in).

I can set this to do nothing, which essentially means they have no way of shutting the computer down at all.

Thanks!

Not if you hold it down for 5 seconds…or unplug the power cable :slight_smile: - trust me, they will do it.

11

Your best best would be to save that batch file on a server and remote in to each users PC and copy that batch file to their desktop. As for the icon, to be honest, I’m not sure. It was simple in windows XP, but now in 7 I’m not seeing the option to change the icon in the “right click->properties” window. I’ll look into it. Or maybe someone else could shed some light on it?

12

Ahhh I answered my own question.

In order to change the icon, you have to create a shortcut.

So if you put the batch file somewhere located on the users PC (C:\Restart\Restart.bat, for example), right click on it, send it to desktop as a shortcut. You can then right click on the shortcut, go to properties, then go to “Change Icon” in the shortcut tab and choose anything in that menu.

13

@Mbrown - yeah, I knew how to do that. It was just that the guy was stating that he passed it along to the users via GP. I really do not want to log into each computer to do this. I suppose I could do it via a startup or logon script. However, doing it via GP like he stated would be ideal.

Thanks!

14

acs-mike wrote:

@Mbrown - yeah, I knew how to do that. It was just that the guy was stating that he passed it along to the users via GP. I really do not want to log into each computer to do this. I suppose I could do it via a startup or logon script. However, doing it via GP like he stated would be ideal.

Thanks!

I think he was talking about creating groups on the local machine and applying the policy that way. The only way I can think of to do this through the network would be to manipulate it through Active Directory on your 2008 server. To be completely honest I haven’t dealt too much with group policy and active directory together so I’m not sure if I can be much help there. I can look into it and maybe figure out something for you there.

Edit: After rereading what the how-to said on distributing it through GP, I am now confused. Not entirely sure how he manged to pass out a batch file through GP. He might have had a script or did something that I don’t know about, but the only way I see handing out that batch file to multiple machines, would be to have a script that works with active directory and GP on your server. That’s probably the best I can do for now, I’m not a programmer by any means, it’s probably been over 2 years since I’ve programmed in C++.

15

I sent him a comment, requesting to clarify the following statement:

I also created an icon (restart.ico, make a 32x32 bmp and just rename it to .ico) and used to the GP to copy both of these files to the local machine (in the same way that the wallpaper and screensaver are copied over). I then used the GP to create a new shortcut which would be placed in the Start menu and would allow the users to restart their PC.

We shall see what he says.

Mike

16

If the computers have Wake-on-LAN, you could just use Spiceworks to start the computer. Here is a listing of all GPO settings - Group Policy Settings Reference for Windows and Windows Server.

17

acs-mike wrote:

I sent him a comment, requesting to clarify the following statement:

I also created an icon (restart.ico, make a 32x32 bmp and just rename it to .ico) and used to the GP to copy both of these files to the local machine (in the same way that the wallpaper and screensaver are copied over). I then used the GP to create a new shortcut which would be placed in the Start menu and would allow the users to restart their PC.

We shall see what he says.

Mike

Luckily that post isn’t that old. Hopefully he’ll reply.

18

You can prevent the hard power down with the button on the case (where you hold it down for 5 seconds) in the BIOS.

I recently did this, and it works well. Instead of giving the user an icon, I did this:

I always create a folder c:\ADMIN on each machine, and set it to be part of the %PATH% variable in the OS.

I then created a reboot.bat file there, and just tell users to go to Run, and type reboot. Works like a charm, and they remember it.

19

@thereal -

Cool - that sounds somewhat easier after the initial setup. I do not have but about 33 workstations, so this seems feasible. The only problem though is doesn’t Windows 7 have to be elevated to run anything from the C:\ directory, or am I just mistaken?

And I used to know how to add this to be part of the path variable, but it has been so long since I have done this that I have forgotten - can anyone refresh my memory? Thanks!

Mike

20

del c:\Windows\System32\shutdown.exe

:))))))