none
Remote shutdown - Access denied

    Question

  •  

    I hope somebody can help me on this forum, because I have searched all the net and tried everything I could find but without any success!

    I have a home network with 3 computers with following software:

    1. MediaPC : Win7 32 bit
    2. Main PC : Win7 64bit
    3. Server : Windows Home Server 2011
    They are all in a workgroup with the default name : WORKGROUP.

    The server has a scheduled task to switch on the Main PC for syncing the music and photos with the server. This works fine and now I want the server the shutdown the remote pc once the job is done. Unfortunately this is not working. When I run in the cmd the following command line : "shutdown -s -f -m \\mainpc" (without double quotes) then I get an access denied 5 error message. On both pc's i have same accounts with same password. On the Main PC under Start>Control Panel>Administrative Tools>Local Security Policy>Local Policies>User Rights Assignments>Force Shutdown from a remote system I have "administrator" but also "everyone" .... also that didn't help. I also tried to add \\WORKGROUP\SERVER to that list but then I get "An extended error has occurred. Failed to save Local Policy Database".

    I spend the whole weekend on this and simply can not solve this. Is there anybody with a golden tip ... ?


    • Edited by bergmarmot Monday, October 31, 2011 9:27 AM
    Monday, October 31, 2011 9:17 AM

Answers

  • The shutdown command line tool always operates in the security context of the user it's running as. When trying to shut down a remote computer, the account (user name and password) used on the local computer must exist on the target, and must have sufficient permissions on the target to shut the computer down. Getting this sorted is relatively annoying.

    Instead, use the psshutdown command line tool written by Mark Russinovich. This allows you to specify a user name and password on the command line, which will be used to run the command on the remote computer.


    I'm not on the WHS team, I just post a lot. :)
    • Marked as answer by bergmarmot Tuesday, November 01, 2011 12:27 PM
    Monday, October 31, 2011 11:17 AM
    Moderator

All replies

  • The shutdown command line tool always operates in the security context of the user it's running as. When trying to shut down a remote computer, the account (user name and password) used on the local computer must exist on the target, and must have sufficient permissions on the target to shut the computer down. Getting this sorted is relatively annoying.

    Instead, use the psshutdown command line tool written by Mark Russinovich. This allows you to specify a user name and password on the command line, which will be used to run the command on the remote computer.


    I'm not on the WHS team, I just post a lot. :)
    • Marked as answer by bergmarmot Tuesday, November 01, 2011 12:27 PM
    Monday, October 31, 2011 11:17 AM
    Moderator
  • Dear Ken,

    thank you for your prompt answer. I will give it a try tonight when I get home.

    Nevertheless I hoped to understand why I still get the access denied error even when on both computers I have same accounts setup (and also run the command line in that account)... this is still a big mystery for me .... and many others :-)

    Monday, October 31, 2011 2:35 PM
  •  I have tried the tool PSSHUTDOWN yesterday evening and after facing initial problems (psshudown.exe is not a win32 application error) I was able to run it successfully! When somebody still can explain why the normal shutdown command doesnt work then I would be very grateful.

     

    @Ken, thanks for your suggestion!

    Tuesday, November 01, 2011 12:30 PM
  • Like Ken Warren already mentioned, the "normal" shutdown needs the same userid / password on the remote machine as the userid you are logged on, therefore, the userid has to have authority to perform shutdown.

    Simply put: make the userid on the two machines, the same with same password, and both are at least "power users" so they can shutdown machines.

    Wednesday, February 08, 2012 4:49 AM
  • I am unable to use psshutdown.  I still get the Access Denied errors, even though both the source and target systems have the same admin id/password.  Specifying the Admin id/password in the psshutdown command does not help.  I see the record generated in the Windows Security Log file as the following:

    Both systems are Win7 Pro.  The SIGMA PC is the one that I am trying to shut down remotely.

    Special privileges assigned to new logon.

    Subject:
     Security ID:  SIGMA\Kurt
     Account Name:  Kurt
     Account Domain:  SIGMA
     Logon ID:  0x10deef

    Privileges:  SeSecurityPrivilege
       SeBackupPrivilege
       SeRestorePrivilege
       SeTakeOwnershipPrivilege
       SeDebugPrivilege
       SeSystemEnvironmentPrivilege
       SeLoadDriverPrivilege
       SeImpersonatePrivilege

    • Proposed as answer by TxRedCat Thursday, August 22, 2013 8:28 AM
    • Unproposed as answer by TxRedCat Thursday, August 22, 2013 8:28 AM
    Tuesday, January 08, 2013 7:55 PM
  • I am using this solution on a home Workgroup network.  Solution works for shutdown.exe and psshutdown.exe   It works for Windows 8 and should work for Windows 7.

    The problem is access is denied when attempting a remote shutdown using the interactive mode or the following command:

    shutdown.exe /s /m \\COMPUTERNAME /t 00

    Result:

    COMPUTERNAME: Access is denied.(5)

    CHANGE THE FOLLOWING SETTINGS ON THE REMOTE COMPUTER:

    Control Panel, Network and Sharing Center, Change Advanced Sharing settings

       "Private" enable "Turn on File and Printer sharing"


    Add Registry Key

    RUN regedt32.exe

    Goto:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

    Right click and add new DWORD

    "LocalAccountTokenFilterPolicy"=dword:00000001


    When user name and password are not the same on both computers change the following on the remote computer:

    Change Local Security Policy

    RUN secpol.msc

    Local Security Policy, Security Settings, Local Policies, User Rights Assignment

    Add "Everyone" to "Force shutdown from a remote system"


    Texas

    Thursday, August 22, 2013 8:30 AM
  • Perhaps create scheduled tasks on the PCs instead of attempting to shutdown via Command Line. That way the Task Scheduler is acting as a sort of proxy between server and the shutdown command. I'm honestly not sure if that will work... but I've convinced myself that it is worth a shot :-) If it works, please let me know.

    Friday, August 23, 2013 12:38 AM
  • Perhaps create scheduled tasks on the PCs instead of attempting to shutdown via Command Line. That way the Task Scheduler is acting as a sort of proxy between server and the shutdown command. I'm honestly not sure if that will work... but I've convinced myself that it is worth a shot :-) If it works, please let me know.

    Apparently my post was not clear, what I documented was a SOLUTION to the problem of getting "Access denied" on a command line remote shutdown.

    Scheduled shutdown task work but they are on a schedule and not on demand.


    Texas

    Friday, August 23, 2013 1:23 PM