Restart access GPO 2

[dparrott]

Hey all,

We want to allow our users to restart the computers, but not to be able to turn them off. Our antivirus runs at night, so we don't want people turning off their computers when they leave. However, due to some of the programs we run (which we cannot get rid of), the computers need restarted sometimes.

Currently, only IT staff and users on laptops have access to the shutdown/restart/logoff buttons. Other users on desktop machines only have log off. We want to be able to allow the users to have access to restart but not shutdown.

Does anyone know how to do this using Group Policy. We are running Windows Server 2003, on the latest service pack, and we are running Windows XP SP2 for the clients.

Thanks,

Danny

 

[MITPRO]

In the group Policy Editor for the specific group, you want to go to User Configuration > Administrative Templates > Start Menu and Taskbar. Select "Remove and Prevent Access to the Shut Down command". Click enable.

remember to do a "gpupdate" once this is saved.

This setting removes the Shut Down option from the Start menu and disables the Shut Down button on the Windows Security dialog box, which appears when you press CTRL+ALT+DEL.

This setting prevents users from using the Windows user interface to shut down the system, although it does not prevent them from running programs that shut down Windows.

If you disable this setting or do not configure it, the Shut Down menu option appears, and the Shut Down button is enabled.


Do not pray to have an easier life, pray to be a stronger man!!!

Comptia A+, Comptia Network +, MCP

 

[dparrott]

MITPRO,

That is what we have done. That also takes the ability to restart the computer away. That is not the desired function. We do not want the user to be able to have the computer turned off short of pulling the plug or pressing the power button on the case for 8 seconds.

Due to memory leaks, the computers need restarted periodically. Due to the virus scan slowing the computer down, we moved the scan to the night. In order to ensure that the virus scan actually runs, we want the computer on at all times. But we need to allow for the periodic restarts by end users.

Thanks for the suggestion, even though it doesn't solve the problem.

 

[needcoffee]

dparrot,

Do the network cards in your workstations have wake-on-lan capabilities? You could use it to restart the machines at a predetermined time.

needcoffee

 

[dparrott]

Not all of them. While that's a good idea, and may work most places, the political climate here makes it so that I cannot do that anyway. It would be my first choice, but sadly won't work.

Thanks,

 

[Leozack]

Alternatively give them an icon on their desktop labelled "Restart System", and set that to run

shutdown -r -f -t 20

This should restart the PC, giving them 20 seconds before it forcefully closes running applications.
Alternately add an extra message with

shutdown -r -f -t 20 "Restarting system - please close all applications immediately"

_________________________________
Leozack

MakeUniverse($infinity,1,42);

 

[Leozack]

Correction to a typo in the last command, the comment requires the -c flag in front of it, ie

shutdown -r -f -t 20 -c "Restarting system - please close all applications immediately"

_________________________________
Leozack

MakeUniverse($infinity,1,42);

 

[dparrott]

leozack,

We had already thought of something almost exactly like that. We were hoping to have something using Group Policy so that we didn't have to put icons on the desktops. Some users get very upset about that.

Thanks for the help so far.

Danny

 

[Leozack]

Well stick it in the startmenu if you have to, a slightly misplaced restart button

_________________________________
Leozack

MakeUniverse($infinity,1,42);