This might sound weird. My colleague and I were working on a Windows machine. He frequently shuts it down through the LAN.

He usually follows these steps:

  1. Access command prompt, enter shutdown -i.
  2. Choose my IP address, click on Shutdown.
  3. Select a timeout of 2–3 seconds.
  4. Click OK

Unfortunately, I cannot disable remote access to my computer. Is there a way to prevent this?

  • 148
    Perhaps you could ask him to stop shutting down your computer remotely as well? It's a waste of company time and resources.
    – Thomas
    Commented Feb 15, 2014 at 7:42
  • 16
    We made a game of this in Uni trying to remote shutdown each other's PC. We all got very good at going Win+r 'shutdown -a'
    – 50-3
    Commented Feb 15, 2014 at 7:43
  • 20
    With great power comes great responsibility.
    – Chris
    Commented Feb 15, 2014 at 9:57
  • 21
    You could either ask him to stop, kindly, or less kindly, ask your superior to make him stop, or plug your/his machine off the network. Just, don't break his arms. It's not considered "acceptable retaliation".
    – Kheldar
    Commented Feb 16, 2014 at 23:21
  • 23
    It's unfortunate that the highest-voted answer, although confirmed by several mods as being on-topic, is now locked and cannot be upvoted; while the technical solution, which many of us obviously believe to be missing the point, is still open for voting. Just saying.
    – alexis
    Commented Feb 17, 2014 at 12:07

8 Answers 8


You are seeking technical solutions to a social problem and you're trying to address the symptoms instead of the underlying cause. This runs the risk of failure if he finds some other way of shutting down your machine.

Talk to your friend and remind him that you're not pals messing about at university, any more: you're professionals being paid to do a job. His behaviour is completely unacceptable in the workplace. He is deliberately stopping you from doing your job which, ultimately, is putting your job at risk. What happens when your boss calls you in to explain your poor performance? Do you accept the blame and get yourself fired? Or do you blame your friend and get him fired? Friends don't put friends in that situation.

Tell your friend that he needs to stop. Right now. Period. If he doesn't, you're going to have to talk to management.

  • 58
    Since there's been some concern about the non-technical nature of this answer: We discussed a similar case a few years ago on the meta site and the consensus is: While questions need to be technical to be on topic, answers don't. They need to answer the question. Which this one does.
    – Daniel Beck
    Commented Feb 15, 2014 at 19:23
  • 1
    Stopping one person in this manner may work, but what happens when an anonymous script kiddie happens onto this security hole?
    – Nick T
    Commented Feb 20, 2014 at 23:15
  • 2
    @NickT If the vulnerability is accessible from outside then a technical fix on the OP's machine won't help much, either, since every other machine in the company will need the same fix. Commented Feb 20, 2014 at 23:18
  • +1 for recognising the difference between a technical and a business situation. Commented Feb 25, 2014 at 9:17
  • Yes, it seems logical that social problems are most often better dealt with social counter-actions. (In some cases, not excluding retaliation). Commented Feb 27, 2014 at 15:38

Run gpedit.msc and try disabling the option as shown below. Restart your PC to see if it works:

enter image description here
Click to enlarge

  • 24
    The right to shut down without logging on pertains to local console shutdowns. For remote shutdowns, you should go to Local Policies | User Rights Assignment | Force shutdown from a remote system. Commented Feb 15, 2014 at 15:52
  • 14
    +1 Finaly a real answer. Enjoy the "Good answer" badge.
    – Tomas
    Commented Feb 16, 2014 at 9:40
  • 3
    @MAKZ I didn't see any mention that his colleague is not an admin. Also, it is the case that the policy you mention pertains to local (console) shutdowns. Read the explanation of the policy. Commented Feb 16, 2014 at 21:36
  • 4
    If the colleague weren't an admin, he wouldn't be able to shut down the machine remotely (unless the machine is badly misconfigured). The setting you've indicated is completely irrelevant. Commented Feb 17, 2014 at 20:16
  • 2
    @MAKZ: the colleague is using shutdown.exe to shut down the OPs machine. This only works because shutdown.exe uses the colleague's network credentials to log into the OPs machine. So the colleague is logged in. Commented Feb 18, 2014 at 19:51

The policy you want to change is in

Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment

Locate the policy named "Force shutdown from a remote system." By default, this policy has a value of Administrators. Just edit it to be an empty list, or put your friendly trusted IT person in there instead.

policy to force shutdown remotely

A note about "Shutdown: Allow system to be shut down without having to log on"

This policy applies to local shutdowns only. That is, it controls whether someone present at the computer can shut it down without having to log on first. By default, this policy is Enabled on workstations, and you can see the shutdown button in the lower right corner of the Windows logon screen.

local shutdown allowed

If you set this policy to Disabled, you will no longer see the shutdown button on the logon screen. A user would have to log on to the computer to shut it down. This is typically how servers are setup.

local shutdown prohibited

This policy does nothing to prevent a remote shutdown. You can try it yourself on a system that you can shutdown remotely. Set this policy to Disabled, and you will still be able to shut down that system.

A note about the Remote Registry service

Disabling the Remote Registry service does not prevent remote shutdowns. Remote Registry only affects the ability of the Shutdown Event Tracker to record the reason for the shutdown. If the reason cannot be recorded, the shutdown still occurs.

  • 1
    Note, however, that if you have administrator access, you can bypass this policy if you really want to. It just makes it a little trickier. The bottom line is that if the bad guy has admin to your machine, you've already lost. Commented Feb 17, 2014 at 21:27
  • @HarryJohnston Not disagreeing, but how is that done? I might need to prevent that in the future, if possible. Maybe I shouldn't ask in public. :) Commented Feb 17, 2014 at 21:28
  • 1
    Well, as an example, you could use psexec to run shutdown on the machine locally. The "deny access to this computer from the network" policy should block this class of attack, but may also prevent legitimate access as in the OPs situation. Commented Feb 17, 2014 at 23:02
  • 2
    True. I always worry about telling people how to set policies in a corporate environment. Hate to make a fellow IT geek mad. Commented Feb 17, 2014 at 23:07

This is a simple way to fix this problem without admin privileges.

But still.. Talk to your colleague man. I leave this with the community for any circumstances where disciplinary action is not readily available e.g internet cafe.

Put below code in a new text file. then change .txt extension to .bat

if you do not see the .txt extension go into:

  1. "folder and search options"
  2. uncheck "hide file extensions for known file types".

If win 8.1/8, in the my documents window, click view tab and find the options button.

Shutdown abort CODE, remember to close it when shutting down.

    cls (clear command prompt window.. Optional)
    @echo Shutting Down Cancel   
    shutdown -a
    goto start

The code is not resource intensive for modern computers and won't show up in virus scanners. - caus it's not a virus =D

  • 17
    This is a bad "solution".
    – Etheryte
    Commented Feb 15, 2014 at 16:34
  • 4
    Why cls if you have already @echo off?
    – Ruslan
    Commented Feb 15, 2014 at 18:01
  • 10
    @MAKZ shutdown -a > NUL is more efficient than shutdown -a with cls
    – frogatto
    Commented Feb 15, 2014 at 21:04
  • 2
    Well it's here if anyone needs it =P CPU KILLER! =D
    – PathToLife
    Commented Feb 16, 2014 at 7:57
  • 2
    Along with this batch file, you should add a step where it checks for an existing pending shutdown initiated by said user, and initiate a shutdown on his machine with a 0 second wait and using the -f switch!
    – ErikE
    Commented Feb 19, 2014 at 1:04

You can disable this by either disabling the Remote Registry service or removing all other access to shutdown

Disable Remote Registry:

sc config "RemoteRegistry" start= disabled

Shutdown location:



Removing access to shutdown.exe will result in some unexpected results when doing any system tasks which involve resets ect...

As for Remote Registry:

Disabling the RemoteRegistry service will break most patch management solutions including the Software Update Service and Windows Automated Update. If you disable this service, you will have to perform patch management manually

-Brian Groth's Life at Microsoft

  • 1
    Uh ... in this scenario, the other user is running the copy of shutdown.exe on their own machine, not the one on the machine being targeted. So deleting your copy really isn't going to help. Commented Feb 17, 2014 at 23:03
  • @HarryJohnston If you remove your colleague's access to shutdown it work
    – 50-3
    Commented Feb 17, 2014 at 23:06
  • ... and what's supposed to stop them from downloading another copy, or any program with similar functionality? Commented Feb 17, 2014 at 23:08
  • What's stopping you from walking over to his desk and flipping the AC/DC switch? there is no way of 100% stopping this behaviour
    – 50-3
    Commented Feb 17, 2014 at 23:50
  • 4
    No, but this option seems particularly ineffective to me. And if you consider the big picture, messing with the other guys computer probably isn't a good idea, as it's only going to escalate things, and it makes you look bad if and when management get involved. Commented Feb 18, 2014 at 0:01

From TechNet:

In order to use this feature, the Remote Registry service must be enabled on the remote computer. See Enable the Remote Registry Service for more information.

Access to the Remote Registry or membership in the Administrators group on the remote computer is the minimum required to complete this procedure.


You could add the following into a file, say, C:\kill-shutdown.ps1, then put the file into the group policy: Local Computer Policy>Computer Configuration>Windows>Settings>Scripts (Startup/Shutdown)>Shutdown

if ((test-path C:\allow-shutdown.txt) -ne $True) { shutdown -a }

Then, if C:\allow-shutdown.txt doesn't exist, it will abort ALL shutdowns.

  • 2
    Probably more efficient than the looping batch file. Sadly needs admin privileges Commented Feb 16, 2014 at 20:48

Remove him from the ipc$ share of your computer:

  • Open Computer Management.
  • If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Yes.
  • In the console tree, click System Tools, click Shared Folders, and then click Shares.
  • In the details pane, right-click the shared folder, and then click Properties.
  • On the Share Permissions tab, set the permissions you want:
  • Add him as user with no rights.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .