Advertisement

Allow or Prevent Users or Groups to Shut Down Windows 10

When you click on the shutdown or restart command in the Start menu or Win + X menu of Windows 10, the operating system performs the selected action directly. You may want to prevent certain users or a group from being able to shut down a Windows 10 device. Here is how it can be done.

Advertisement

Windows has undergone many changes from Windows XP to Windows 10. Today, the operating system has slightly different ways to do the same tasks. Windows 10 offers various ways to restart and shutdown a PC. The 'Shut down the system' user right is required to enable hibernation support, to set the power management settings, and to cancel a shutdown.

There is a special security policy that can be used to prevent certain user accounts or group from shutting down a Windows 10 device.  Let's see how it can be done.

If you are running Windows 10 Pro, Enterprise, or Education edition, you can use the Local Security Policy app to change the policy. All editions of Windows 10, including Windows 10 Home, can use an alternative solution mentioned below.

To Allow Users or Groups to Shut Down Windows 10,

  1. Press Win + R keys together on your keyboard and type:
    secpol.msc

    Press Enter.Windows 10 Secpol

  2. Local Security Policy will open. Go to User Local Policies -> User Rights Assignment.Windows 10 Secpol User Right Assignment
  3. On the right, double-click the option Shut down the system.
  4. In the next dialog, click Add User or Group.Windows 10 Add Users To Shut Down Policy
  5. Click on the Advanced button.Windows 10 Add Users To Shut Down Policy 2
  6. Now, click on the Object Types button.Windows 10 Add Users To Shut Down Policy 3
  7. Ensure that you have the Users and Groups items checked and click on the OK button.Windows 10 Secpol Deny Logon Locally 5
  8. Click on the Find now button.Windows 10 Secpol Deny Logon Locally 6
  9. From the list, select the user account or group to deny log on locally for it. You can select more than one entry at once by holding the Shift or Ctrl keys and clicking on the items the list.
  10. Click on the OK button to add the selected items to the Object names box.Windows 10 Secpol Deny Logon Locally 7
  11. Click on the OK button to add the selected items to the policy list.Windows 10 Add Users To Shut Down Policy 4

You are done.

To Prevent Users or Groups from Shutting Down Windows 10,

  1. Press Win + R keys together on your keyboard and type:
    secpol.msc

    Press Enter.Windows 10 Secpol

  2. Local Security Policy will open. Go to User Local Policies -> User Rights Assignment.Windows 10 Secpol User Right Assignment
  3. On the right, double-click the option Shut down the system.
  4. Select an entry, use the Remove button in the policy dialog.Windows 10 Prevent Users From Shutting Down

If your Windows edition doesn't include the secpol.msc tool, here is an alternative solution.

If your Windows edition doesn't include the secpol.msc tool, you can use the ntrights.exe tool from Windows 2003 Resource Kit. Many resource kit tools released for previous Windows versions will run successfully on Windows 10. ntrights.exe is one of them.

The ntrights tool

The ntrights tool allows you to edit user account privileges from the command prompt. It is a console tool with the following syntax.

  • Grant a right: ntrights +r Right -u UserOrGroup [-m \\Computer] [-e Entry]
  • Revoke a right: ntrights -r Right -u UserOrGroup [-m \\Computer] [-e Entry]

The tool supports plenty of privileges which can be assigned to or revoked from a user account or group. Privileges are case sensitive. To learn more about the supported privileges, type ntrights /?.

To add ntrights.exe to Windows 10, read this post: What is the ntrights app and how you can use it. You can place the ntrights.exe file to the C:\Windows\System32 folder to quickly call it.

Revoke Shut Down Right with ntrights

  1. Open an elevated command prompt.
  2. Type the following command to deny Shut Down right:
    ntrights -u SomeUserName +r SeShutdownPrivilege

    Substitute the SomeUserName portion with the actual user name or group name. The specified user will be prevented from locally signing to Windows 10.

  3. To undo the change and allow the user to log on locally, execute
    ntrights -u SomeUserName -r SeShutdownPrivilege

That's it.

Related articles.

Support us

Winaero greatly relies on your support. You can help the site keep bringing you interesting and useful content and software by using these options:

If you like this article, please share it using the buttons below. It won't take a lot from you, but it will help us grow. Thanks for your support!

Advertisment

Author: Sergey Tkachenko

Sergey Tkachenko is a software developer who started Winaero back in 2011. On this blog, Sergey is writing about everything connected to Microsoft, Windows and popular software. Follow him on Telegram, Twitter, and YouTube.

Leave a Reply

Your email address will not be published.

css.php
Using Telegram? Subscribe to the blog channel!
Hello. Add your message here.