Shutdown.exe - Change the path in registry

Question

I have a problem with the registry. In my school are some trolls which create links and batch files to shutdown the computers of others by placing them into shared folders and giving them names similar to the files we should use (eg. "tcp.bat" or "tcp.java(.lnk)" instead of "tcp.java", which is hidden in a subdir so the students open the bad file).

To do this they all use shutdown [args] or shutdown.exe [args]. For my school I have written a program to stop this by modifying the -t argument to at least one minute so the students can get some help from a teacher. But now I have a problem:

I thought that there are entries in the registry which point to the complete path of shutdown.exe, but nothing. I searched for shutdown.exe and shutdown, but found noting pointing to the shutdown.exe. So now my question:

What do I have to change where to make using shutodwn or shutdown.exe points to my program instead of the shutdown.exe?

Thank you for any help!

Answer 1

To answer the question you asked (spoiler - it wont solve your issue)...

open a command prompt and type:

 echo %PATH%

That list of directories is where Windows looks for executable files (after the current directory), working from left to right until it finds a matching .exe or fails. If you insert a folder into your users' PATH variable before c:\windows\system32; eg c:\myscripts;c:\windows\system32; your c:\myscripts\shutdown.exe will be found first.

You may need to update both the system, and each users PATH variables to ensure your shutdown.exe is found, but this can be easily defeated. There are several methods to shutdown a computer via script or compiled code or even rundll32.exe. Also this wont prevent absolute or relative paths to the real file. Shutdown.exe is just a convenience, its not core to Windows shutting down. That said, I wouldnt try tampering with the file itself, while you might get your version to "stick", its only a matter of time before windows replaces it with the original.

Personally I would seriously look at group or local policy (depending on your network) to just revoke shutdown permissions for the problem users. It doesn't matter if a user runs the exe, if they dont have permission to shutdown the machine, the operation will fail.

If you cant lock down the systems for whatever reason your options are pretty limited.

Maybe instead of writing a shutdown replacement, run a script on a schedule (or write a service etc) on your file server that scans for any suspect files like .lnk, or .bat files and deletes them (or better yet take ownership and revoke access to the file so you can inspect / log who created it/which computer etc) and take any action.

You could take this even further with some code by using a filesystem watcher on the shared folder (from the file server itself!) your application will be notified of each new filename created in pretty much realtime and you can take whatever action. (like turning off the attackers computer :)

Answer 2

I agree with Doug Deden's comment that this sounds like an XY problem and changing some access permissions is probably a better way. Since this may still have some value regardless, here is a possible alternative.

The path to shutdown.exe is not set in the registry, but in your PATH variable. shutdown.exe is located in C:\Windows\System32, which is listed in your PATH variable. In order to find this for yourself, you can run where shutdown.

One option is to name your program shutdown.exe or shutdown.bat in whatever location you prefer and then add that location to the front of the PATH variable.

When you then run where shutdown, you will see something like:

C:\my\path\shutdown.exe
C:\Windows\System32\shutdown.exe

This list is in order of priority, so Windows will run the first item in the list unless otherwise specified. This would work to stop anyone who simply runs shutdown -s -t 0, but not anyone running C:\Windows\system32\shutdown -s -t 0.

Further Reading

• Where - SS64.com
• Shutdown - SS64.com

Answer 3

Your best option is to actually replace the shutdown.exe in c:\windows\system32\shutdown.exe with your newly created .bat compiled into an .exe. To do so, you can follow the post here to convert your bat to exe. Assuming your bat just says shutdown /s /t 60 this should be fairly simple.

How can I convert a Windows batch script to a .exe?

Also, another way to abort the shutdown is just to bring up cmd while the timer is counting down and type shutdown /a