DIsabling the shutdown command, not just hiding it

[mwingeier]

I recently came across a bug in one of my company's applications whereby when I was logged on to the terminal server and hit the application shutdown button, the whole server shut down. When asking why this happened, the reply was that it was by design: the program sends a system call to shut down workstations (which is desired) regardless of priviledge level, but can't tell the difference between a workstation that is OK to shut down, and a server that is not.
I am unable to modify these routines, as the reponse I get is that they are working as intended. I have looked at the various ways to hide shutdown from users, but the call is still available, and so this program can still shut things down. Given this set of circumstances, is there a way to disable the shutting down of the system by this call, but still allow normal administrator access to shut it down if needed?

 

[paulhthomas]

hmmm, interesting
How about creating a software restriction policy, to stop non admins running the shutdown.exe file?


Paul Thomas
Important IT

http://www.ImportantIT.com

 

[jknichols]

As Paul said:

hmmm, interesting

My question is: Is this a "Bug" in your application or a "Bug" in terminal server - If your application is running with the user's privileges, then theoretically any user of a terminal server could shut down the whole server, which is not a good thing ;-)

 

[mwingeier]

It appears to be a flaw in the way the shutdown routine that is being called, was designed. Since non-admins log into these stations, the routine was designed to shut down the station regardless of access level. From what I have been told, this is happening because the routine calls the shutdown process with the system account. Obviously blocking the system account from executing a shutdown would be a bad thing indeed, and this routine sends a blind shutdown, not caring what system it is trying to shut down.
So in the end, I am looking to block system level calls for shutdown, but still allow an admin interactive session to shut down the system. At first glance, it wouldn't seem possible, but someone may know a trick that I am unaware of. I'm just trying to patch my end to fix someone else's bad programming.