[johnmack20]

I work in a network computer environment and recently everyone here has learned how to remote restart other users computers using administrator rights.
It is done through the cmd prompt the way we were shown.

My question is this. Is there anyway to change security settings or prevent people from being able to remote shutdown your computer? If not, is there anyway to figure out who is doing this? Possibly a shutdown log or something of that nature.

Working in an office environment like this and having someone who's messing around, if you dont save your work every 5 minutes your work gets flushed.

Any help would be appreciated

 

[BMR777]

Are they using the shutdown.exe method? If yes, there may be a workaround.

If you lock your workstation (WinKey + L) they might not be able to remote restart your PC, but it might do nothing or log you off. You had best try this when you don't have any essential things open.

Also, if you find you are in the middle of a shutdown, you can type this into the run box:

shutdown -a

to abort shutdown.

BMR777

 

[johnmack20]

yes, i understand that i can just do a shutdown -a,
however the person shutting down has been running a shutdown -t 00 to give you 0 seconds to respond to the shutdown, it's instant

 

[BMR777]

Can they still do it if you lock your workstation?

 

[johnmack20]

negative, if the workstation is locked i do believe an error pops up telling them that the workstation is locked and cannot be restarted.

However most of the time they try to do the remote shutdown i'm on the machine so so everything just closes and and says windows is shutting down

They do it through the cmd prompt using shutdown -s -m \\compname -t 00 under an admin name. I know there are also several users within our office that cannot work with cmd prompt so they have a program they use.