"Force shutdown from a remote system"

Discussion in 'Windows Vista Security' started by Guest, Oct 13, 2006.

  1. Guest

    Guest Guest

    What do they really mean by this? I was able to shut down a server with no
    users having this user right, using terminal services. I took everyone out
    of this user right, and I refreshed the policy then connected to the server
    via terminal services, and proceeded to shut it down, no problem. What kind
    of tool does this policy expect the remote user is going to be using to
    accomplish the shutdown? 'Cuz it sure ain't terminal services.

    Any ideas appreciated.
     
    Guest, Oct 13, 2006
    #1
    1. Advertisements

  2. Who are 'they" and where are you getting this from?
    IE: methinks you left out a few details.
     
    Shenan Stanley, Oct 13, 2006
    #2
    1. Advertisements

  3. Generally speaking a terminal services login is considered
    to be a local login as there is a winstation session.
    Remote login is via such as a WMI shutdown command,
    which is a small network transmission.
     
    Roger Abell [MVP], Oct 13, 2006
    #3
  4. I believe the "they" is MSFT when "this" user right
    was given a descriptive name, which differs in XP
    where it is "Force shutdown from a remote system"

    Roger
     
    Roger Abell [MVP], Oct 13, 2006
    #4
  5. Ah.. Thanks Roger.
    I appreciate the clarification.
     
    Shenan Stanley, Oct 13, 2006
    #5
  6. I think you are refering to a GP setting and this can override someone with
    local admin privs on a box from executing a remote shut down with the
    "shutdown" command.

    e.g.

    shutdown /s /m \\jimbo /e "I am being annoying and shutting down Jimbo's
    workstation"

    Kind regards,

    Jimbo.
     
    James Saveker, Oct 14, 2006
    #6
  7. Ummm . . . no, this user right grants that capability,
    not denies it, so it certainly cannot be used to prevent
    an account from using their capabilities.
     
    Roger Abell [MVP], Oct 14, 2006
    #7
  8. Guest

    Guest Guest

    But, in terms of the _method_ of shutdown, the shutdown.exe command is the
    only method this policy addresses?
     
    Guest, Oct 16, 2006
    #8
  9. No.

    shutdown.exe is just a little exe MS made available at one time that has
    stuck

    I have spent a little time trying to see whether I can find a statement as
    to just
    exactly what APIs, what providers, what namespace classes' methodes are
    covered by this settings.

    Hoevers, all that I have found just says, as this from the W2k3 Security
    Guide
    <quote>
    This policy setting determines whether users can shut down computers from
    remote locations on the network. Any user who can shut down a computer could
    cause a DoS condition. Therefore, this user right should be tightly
    restricted.

    </quote>

    In other words, the statements I have seen just make unconditional statement
    that this allows use of remote means for shutdown, from which it seems that
    all available ways are wired to obey thius right.

    I know that when I use Wmi it is a requirement that one specify the shutdown
    right when initially instancing the objects one uses (and of course this
    explicit
    request is only honored if it is granted to the account in use) because
    otherwise
    this is not enabled on the object obtained even when allowed to the account
    used.
     
    Roger Abell [MVP], Oct 17, 2006
    #9
  10. Guest

    Guest Guest

    So, what exactly is the point of this policy, it doesn't really seem to do
    anything.
     
    Guest, Oct 18, 2006
    #10
  11. Guest

    Jimmy Brush Guest

    This policy sets which user accounts can gain the "shutdown computer"
    privilege, which is required to shutdown the computer. This is handled at
    the authentication level.

    Whenever a user logs into the system, whether from over the network or
    locally at the computer, the system assigns that user login with a set of
    privileges. Any program that user runs can only do what those privileges
    allow for that user.

    It should be impossible to shutdown the system unless you have this shutdown
    privilege, regardless of which API or command is used.

    When a user logs in from a network location, as is the case with say typing
    \\computername into an explorer window, using the computer administrator or
    other mmc console to remotely administrate another computer, using one of
    the many command-line tools available to remotely administrate a remote
    computer such as the NET and SHUTDOWN command, etc, the system that you are
    connecting to realizes that this is a network login and either assigns or
    unassigns the shutdown privilege based on that policy setting.

    In short:

    "Force shutdown from a remote system" controls who gets the system shutdown
    privilege when logged in via networking services.

    "Shut down the system" controls who gets the system shutdown privilege when
    logged in interactively.

    This last statement is the kicker - When you connect to a computer using
    Remote Desktop, as was mentioned in another reply, you are given a desktop
    as if you were physically at the computer; this is considered an
    "interactive" login, and NOT a network login, so the second policy setting
    is used in this case to determine whether to assign the shutdown privilege.
     
    Jimmy Brush, Oct 19, 2006
    #11
  12. Guest

    Guest Guest

    Thanks Jimmy,

    That really does clarify it. Fortunately for us, the only way we shut down
    or reboot DC's is from Remote Desktop, or that rare instance in which we are
    physically at the box. It also illuminates why it was recommended to us to
    have the DC policy not have anyone have this right.
     
    Guest, Oct 19, 2006
    #12
  13. Guest

    jamieduk Guest

    i can do a remote shutdown on any device with a mac address as long as
    you are on the local network (even via rdp) using lan cables not wirless
    and pc will shutoff but across net i dont know how even to detect this
    and both would be good to lern any ideas>?
     
    jamieduk, Jul 11, 2009
    #13
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.
Similar Threads
There are no similar threads yet.
Loading...