I am enforcing a hardening policy on my organization's work stations. One of the policies I removed, under Shutdown, is called "Allow system to be shut own without having to log on".

Users started to complain and asked us to re-enable this policy, and I tend to agree. Can you think of a good reason why to disable ?

  • Please rephrase clearly which function is enabled within your actual policy. – daniel Azuelos Dec 6 at 15:40
  • Hrm. In theory requiring login before shutdown prevents loss of data from unsaved documents, if someone else is logged in. Normal shutdown notifies you "hey, other people are logged in, are you sure?", but I can't recall if the login screen will also warn you. It would be better to teach people to save early and often if this is a concern, however (since it also covers loss-of-power events). Note that there's no way to protect against a malicious shutdown, since the attacker can just unplug the machine. – Clockwork-Muse Dec 6 at 18:21
  • If the machines have public accesssible power switches or power cords it just introduces more risk for corruption without adding any additional protection. – eckes Dec 7 at 20:05

That policy may source from the CIS Benchmarks, but is intended for servers, not for user workstations. To quote §2.3.13.1 (and note the Profile Applicability and Impact sections):

2.3.13.1 (L1) Ensure 'Shutdown: Allow system to be shut down without having to log on' is set to 'Disabled' (Scored)

Profile Applicability:

  • Level 1 - Domain Controller
  • Level 1 - Member Server

Description:

This policy setting determines whether a computer can be shut down when a user is not logged on. If this policy setting is enabled, the shutdown command is available on the Windows logon screen. It is recommended to disable this policy setting to restrict the ability to shut down the computer to users with credentials on the system. The recommended state for this setting is: Disabled.

Rationale:

Users who can access the console locally could shut down the computer.

Attackers could also walk to the local console and restart the server, which would cause a temporary DoS condition. Attackers could also shut down the server and leave all of its applications and services unavailable.

...

Impact:

Operators will have to log on to servers to shut them down or restart them.

The idea being that a user might not have privileges to log into a server, but with physical access, they would be able to shut it down. Consider the HVAC guy working in your server room, etc. etc.

It is reasonable for you to allow your users to shut down workstations.

  • The quote has a different phrasing of the setting. So the recommendation in quote is disabled and your is enabled even though both recommend the same thing. I recommend rephrasing your last sentence. Still +1 – Peter Harmann Dec 6 at 18:41
  • 1
    Thanks @PeterHarmann that whole 'enable to disable' thing is always a mess! I reworded it to clarify the acceptable behavior rather than the setting. – gowenfawr Dec 6 at 18:48
  • Some establishments require to keep the selected workstations running round the clock, so that the users could continue doing the work after a break of couple of hours or in next shift. Not all workstations would require this restriction in an energy conservation point of view. – Nikhil_CV Dec 7 at 6:13
  • The policy may source is not CIS (maybe based on it) and its meant for workstations specifically. either way i see way it is good for servers and that i can do without it on workstations, thanks a lot – BokerTov Dec 9 at 6:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.