Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Shut Down Computer - Allow or Prevent Users and Groups


Shut Down Computer - Allow or Prevent Users and Groups

How to Allow or Prevent Users and Groups to Hibernate, Restart, Shut Down, and Sleep the PC
Published by Brink
05 Dec 2010
Published by

How to Allow or Prevent Users and Groups to Hibernate, Restart, Shut Down, and Sleep the PC


information   Information
This will show you how to allow or prevent specific users and groups from being able to Shut Down, Restart, Sleep, and Hibernate the computer in Vista, Windows 7, and Windows 8.

You will need to be logged in as administrator to be able to do this tutorial.

Note   Note
Default Users and Groups Allowed to Shut Down the Computer
NOTE: This security setting determines which users who are logged on locally to the computer can shut down the operating system using the Shut Down command.

On a Local Computer or Workstation (ex: home computer): Administrators, Backup Operators, Users

On a Server: Administrators, Backup Operators

On Domain: Administrators, Backup Operators, Server Operators, Print Operators


EXAMPLE: Shut Down Set to be Prevented
Name:  Start_Menu.jpg
Views: 55956
Size:  63.0 KBName:  Start_Menu_Power-Button-options.jpg
Views: 55908
Size:  55.8 KB
-windows_8_power_menu.jpg



OPTION ONE
Through Local Security Policy
1. Open the Local Security Policy window, expand Local Policies in the left pane, and select User Rights Assignment. (see screenshot below)
-step-1.jpg
2. In the right pane of User Rights Assignment, double click on Shut down the system. (see screenshot above)

3. To Prevent Users or Groups to be able to Shut Down the Computer
A) Select (highlight) listed user(s) and/or group(s) that you do not want to be allowed to shut down the computer anymore, then click on the Remove button. (see screenshot below)
NOTE: You can press and hold the CTRL key to select more than one listed user and group.
Name:  Remove-1.jpg
Views: 56133
Size:  43.5 KB
Tip   Tip
To Only Prevent Specific Users
  • To only prevent specific "standard users", you will also need to remove the Users group in addition to step 3A, then only add each standard user account name in step 4 that you want to be able to shut down the computer.
  • To only prevent specific "administrators", you will also need to remove the Administrators group in addition to step 3A first, then only add each administrator user account name in step 4 that you want to be able to shut down the computer.
B) Click on Apply. (see screenshot below)
Name:  Step-2.jpg
Views: 55780
Size:  42.5 KB
4. To Allow Users or Groups to be able to Shut Down the Computer
A) Click on the Add User or Group button. (see screenshot above)

B) To Change the Location to Search for "Object Types"

NOTE: This is only if you wanted to search for object types to allow from a location other than your local computer. If you only want to search from your computer, then skip this step and go to step 4C.
  • Click on the Locations button. (see screenshot below step 4C)
  • Select a location, and click on OK. (see screenshot below)
Name:  Location-1.jpg
Views: 55662
Size:  28.9 KB
C) Click on the Advanced button. (see screenshot below)
Name:  Add-1.jpg
Views: 55685
Size:  38.5 KB
D) Click on the Object Types button. (see screenshot below)
Name:  Add-2.jpg
Views: 55767
Size:  57.8 KB
E) Check all boxes or the "object types" (ex: Users or Groups) that you want to find and select from in step 4G, and click on OK. (see screenshot below)
Name:  Add-3.jpg
Views: 55617
Size:  32.3 KB
F) Click on the Find Now button. (see screenshot below)
Name:  Add-4.jpg
Views: 55632
Size:  58.1 KB
G) In the bottom pane under Search results, select the user account name(s) and/or groups that you want to be allowed to shut down the computer, then click on OK. (see screenshot below)
NOTE: You can press and hold the CTRL key to select more than one listed users (user account names) or group.
-add-5.jpg

Tip   Tip
To Only Allow Specific Users
  • To only allow specific "standard users", you will need to remove the Users group in step 3 first, then add each standard user account name that you want to be able to shut down the computer.
  • To only allow specific "administrators", you will need to remove the Administrators group in step 3 first, then add each administrator user account name that you want to be able to shut down the computer.

H) Click on OK. (see screenshot below)
Name:  Add-6.jpg
Views: 55441
Size:  40.8 KB
I) Click on Apply. (see screenshot below)
Name:  Add-7.jpg
Views: 55446
Size:  43.3 KB
5. When finished, click on OK. (see screenshots below steps 3B and 4I)

6. Close the Local Security Policy window. (see screenshot below step 1)

7. Sometimes you may need to log off and on, or restart the computer to apply.



OPTION TWO
Using "ntrights.exe" and an Elevated Command Prompt

NOTE: Be sure to write down changes you make to the user rights assignment so that you will know what you changed later. Please see the NOTE box at the top of the tutorial for the default user rights assignments.
1. If you have not already, click/tap on the Download button below to download the ntrights.zip file originally from within the Windows Server 2003 Resource Kit Tools.
download

A) Save the ntrights.zip file to your desktop.

B) Unblock the ntrights.zip file.

C) Open the ntrights.zip file, and extract (drag and drop) the ntrights.exe file to your desktop.

D) Right click on the ntrights.exe file, and click on Move.

E) Open Windows Explorer and navigate to and open the C:\Windows\System32 folder, then Paste the ntrights.exe file to move it here.

F) If prompted, click/tap on Continue and Yes to approve moving the ntrights.exe file into the System32 folder, then close the Windows Explorer window.
2. Open an elevated command prompt (Run as administrator).

3. To Prevent Users or Groups to be able to Shut Down the Computer
A) In the elevated command prompt type in the command below and press enter. (see screenshot below)
NOTE: Substitute User or Group in the command below with the actual user account name (ex: Users) or group name within quotes that you want to prevent.
ntrights -U "User or Group" -R SeShutdownPrivilege

Name:  CMD-Remove.jpg
Views: 55830
Size:  38.5 KB





Tip   Tip
To Only Prevent Specific Users
  • To only prevent specific "standard users", you will also need to remove the Users group in addition to step 3A, then only add each standard user account name in step 4A that you want to be able to shut down the computer.
  • To only prevent specific "administrators", you will also need to remove the Administrators group in addition to step 3A first, then only add each administrator user account name in step 4A that you want to be able to shut down the computer.

4. To Allow Users or Groups to be able to Shut Down the Computer
A) In the elevated command prompt type in the command below and press enter. (see screenshot below)
NOTE: Substitute User or Group in the command below with the actual user account name (ex: Users) or group name within quotes that you want to allow.
ntrights -U "User or Group" +R SeShutdownPrivilege

Name:  CMD-Add.jpg
Views: 55533
Size:  37.7 KB





Tip   Tip
To Only Allow Specific Users
  • To only allow specific "standard users", you will need to remove the Users group in step 3A first, then add each standard user account name that you want to be able to shut down the computer.
  • To only allow specific "administrators", you will need to remove the Administrators group in step 3A first, then add each administrator user account name that you want to be able to shut down the computer.

5. When finished, close the elevated command prompt.

6. Sometimes you may need to log off and on, or restart the computer to apply.
That's it,
Shawn








Related Tutorials

10 Dec 2010   #1
Capt.Jack Sparrow

Windows 7 Ultimate - 64-bit | Windows 8 Pro - 64-bit
 
 

Great Tutorial Shawn ! I like the Method 2 the most


My System SpecsSystem Spec
10 Dec 2010   #2
Brink
Microsoft MVP

64-bit Windows 10 Pro
 
 

Thank you Shyam.
My System SpecsSystem Spec
10 Dec 2010   #3
sygnus21

Windows 10 Pro
 
 

Now I'll just have to go in the BIOS and configure the shutdown switch
My System SpecsSystem Spec
.

13 Oct 2011   #4
usa

windows 7 32bit
 
 
kinda worked

this kinda help but i want to still allow users to lock,restart, log off. i only want to prevent them from shutting down, sleep, and hybernate
My System SpecsSystem Spec
13 Oct 2011   #5
Brink
Microsoft MVP

64-bit Windows 10 Pro
 
 

Hello USA, and welcome to Seven Forums.

Yeah, unfortunately "Restart" is part of the shutdown options. I do not know of another option that would disable all of these without it also including "Restart".

A workaround for restart being disabled would be to log off, then manually restart the computer using the restart button on the computer case.

Hope this helps,
Shawn
My System SpecsSystem Spec
01 Jan 2012   #6
dustyt

Seven Home Premium x64 / Vista Home Premium x86
 
 
It works!!!

Worked just as expected on Seven Home Premium x64. Does the tool in option 2 work in Vista Home Premium x86? How about XP Pro? As always, any help is very appreciated.

Thanks everyone for your posts.
Dusty
My System SpecsSystem Spec
01 Jan 2012   #7
Brink
Microsoft MVP

64-bit Windows 10 Pro
 
 

Hello Dusty, and welcome to Seven Forums.

Both options work in Windows 7 and Vista, but I haven't tried option two in XP though. It's not going to hurt anything to try it XP though. It'll either work or not.
My System SpecsSystem Spec
01 Jan 2012   #8
dustyt

Seven Home Premium x64 / Vista Home Premium x86
 
 

Thanks, will try on XP Pro.

Also, does this prevent shutdown from cmd prompt? I would like to restrict Vista Home Premium x86 but the system only has one user (admin) so the only way to shut down if I do this is a cmd prompt.

Thanks,
Dusty

No, option 2 doesn't work in XP Pro, returns "invalid application" message
My System SpecsSystem Spec
01 Jan 2012   #9
Brink
Microsoft MVP

64-bit Windows 10 Pro
 
 

Dusty,

When they (tested with standard user) run the shutdown /f command in a command prompt, it will only log them out instead. The other switch options get a access denied message. So, yep it basically still prevents them in a command prompt as well.

Thank you for confirming that it doesn't work in XP.
My System SpecsSystem Spec
Comment

 Shut Down Computer - Allow or Prevent Users and Groups




Tutorial Tools




Similar help and support threads
Windows 7 Tutorial Category
Date and Time - Allow or Prevent Users and Groups from Changing
How to Allow or Prevent Specific Users and Groups from Changing the Date and Time in Windows This will show you how to allow or prevent specific users and groups from being able to change the computer date and time in Vista, Windows 7, and Windows 8. You will need to be an administrator to...
Tutorials
Take Ownership - Allow or Prevent Users and Groups To
How to Allow or Prevent Users and Groups to be able to Take Ownership This will show you how to allow or prevent specific users and groups from being able to Take Ownership of items such as a file, folder, registry key, drive, or other objects in Vista, Windows 7, and Windows 8. You will...
Tutorials
bsod computer shut down to prevent damage error
My laptop shut down suddenly by giving blue screen with crash dump error.. and runs very slowly please help
BSOD Help and Support
bsod computer shut down to prevent damage error
i get this error i have uploaded the debug-YourComputerName-xxxx.zip file A problem has been detected and Windows has been shut down to prevent damage to your computer. If this is the first time you've seen this Stop error screen, restart your computer. If this screen appears again, follow...
BSOD Help and Support
Can't Find Local Users and Groups in Computer Management
Hi, While trying to set-up a SQL Server account in Computer Management I've discovered that "Local Users and Groups" doesn't exist under System Tools tree. I select Start > Computer (right click) > enter admin. password > Computer Mgmt. opens and under System Tools there is no listing for "Local...
General Discussion
Time Zone - Allow or Prevent Users and Groups from Changing
How to Allow or Prevent Specific Users and Groups from Changing the Time Zone in Windows This will show you how to allow or prevent specific users and groups from being able to change the computer time zone in Vista, Windows 7, and Windows 8. You will need to be logged in as an administrator...
Tutorials


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 23:37.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App