Detections
Analytics

Force shutdown from a remote system

Information

Force shutdown from a remote system

This security setting determines which users are allowed to shut down a computer from a remote location on the network. Misuse of this user right can result in a denial of service.

This user right is defined in the Default Domain Controller Group Policy object (GPO) and in the local security policy of workstations and servers.

Default:

On workstations and servers: Administrators.
On domain controllers: Administrators, Server Operators.

Solution

Policy Path: User Rights Assignments
Policy Setting Name: Force shutdown from a remote system

See Also

https://techcommunity.microsoft.com/blog/microsoft-security-baselines/windows-11-version-25h2-security-baseline/4456231

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(7)(b)

Plugin: Windows

Control ID: 6495bb069d602d84db638a1e86015a61e1e935f11a484a7a3ecb515eb489cebb