Windows 7: Prevent Guest Shutting Down Computer

Question

I have read many times that you can stop the Guest account on Windows 7 from shutting down the computer using

shutdown -s 

in the command line by ensuring that

Local Policies\User Rights Assugnment\Shut Down The System

doesn't include the Guest account.

I've just tried this and was able to shut down the computer from the Guest account. I've also tried this in a clean install of Windows 7 Pro in VMware Player and get the same behaviour.

What have I misunderstood?

Answer 1

This yields a list of all groups with the ability to shut down the computer:

Windows Key -> in search type "Local Security Policy" and open the program. Local Policies-> User Rights Assignment -> Double-click Shut down the system.

The Guest account is (probably) in one of those groups - I would guess 'Users' if it is not explicitly named in the list - verify group membership by running 'compmgmt.msc'

Of note: The guest account is, by default, a member of the 'YourDomain\Domain Users' group (if memory serves) which is a member of the Users Group.

If you want to verify group membership, running this command from powershell should spit it out assuming that you have the powershell activedirectory module:

Get-ADPrincipalGroupMembership guest | select name

If using a command prompt is still allowing the activity, you can (and probably should) disable the command prompt for the guest account using gpedit.msc - it is under Group Policy->user configurations->administrative templates-> system -> "prevent access to the command prompt"