I was wondering if anyone knows how to configure a Windows 7 x64 Enterprise install that is on a domain to run a script if the user attempts to shutdown the computer - but I dont want the script to run if the user tries to log out.

Here is a bit of detail on my situation...

I have installed drive encryption software on 5 desktops that are in use by various people in my group. These desktops are installed a few buildings away in a secure lab that very people have access to. People in my group access these machines (8 Core 2600K Intel Sandybridge with 8GB RAM) over RDP to preform tasks that require heavy lifting that laptops are not well suited for.

I wrote a shutdown script (.hta file) to warn a user that if he/she shuts the computer down, they will have to get access to the lab and enter the drive encryption password in order to bring the machine back online. The script has a timer that counts down for 1 minute and allows the user to cancel the shutdown command.

The script works as expected when a user tries to shutdown the computer, but I just realized that the script seems to run when a user tries to log off. Is there any way to differentiate between a user logging off and a user shutting down a machine? If possible, I would only want the script to run if the machine is shutdown. If the user logs out, I would not want any script to run.

If this is possible, it seems like this would be managed via local Group Policy.

Let me know if you need any further details.

  • 2
    why not just prevent them from shutting down? When I ran a computer lab, that's what I did. – MDT Guy Apr 1 '13 at 20:43

There are two ways to achieve this. If you have an Active Directory domain this would be what I advise as it would be the easiest to configure. You can just add these special computers to their own OU and apply a GPO to the OU. Otherwise you will need to apply the shutdown script using the Local Policy manager on each individual computer:

Shutdown Scripts through Group Policy:


Shutdown Scripts through Local Policy:


However by default Shutdown output aren't visible by default. You will need to make another change the policies to make sure they are:


I'm not sure if an HTA will work, but if you just want to make sure a message displays prior to shutting down you could easily convert to a .vbs or .bat file.

  • Just a tip: If you use AD, you don't have to have the computers in their own OU. You can put the computers in a group and only let the GPO apply to that group. – Patrick Seymour Apr 2 '13 at 0:51

So, I figured it out myself - but not without everyone's help - so thanks.

I just noticed the following

There are GPOs for both Shutdown and Logoff scripts

Log off scripts are in User Configuration/Windows Settings/Scripts (Log on and Log off)

Shutdown scripts are in Computer Configuration/Windows Settings/Scripts (Startup/Shutdown)


Yes, in group policy you can place the script in

Computer Configuration\Windows Settings\Scripts\Shutdown

However, don't be surprised if people leave after the machine logs off, and never see your message. I would disable shutdown as was left in the comments of your question.

  • I already have shutdown disabled, but what stops someone from running shutdown /s /t 0 at the run prompt? Also, how would I shut down the machine if needed other than going to the secure lab and logging in locally? Does that GPO only apply to non-admin users or to all users of that system? – Richie086 Apr 2 '13 at 3:36
  • disabling access to the run prompt would stop that, that's correct it does not apply to local admins. – MDMoore313 Apr 2 '13 at 12:29
  • @BigHomie instead of "run prompt", they can create shortcut. And if even this won't help, they could just pull the plug. It's not any better, so better let them shutdown gracefully. – LogicDaemon Jan 23 '15 at 9:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.