Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a very powerful PC that is capable of running several environments.

This computer is running Windows Server 2008 R2 with Hyper-V feature

I want to allow a user to physically use the computer while Hyper-V is running, to do so I created another user account.

Is there any option to disable, restart or shutdown and still let the user have admin privileges?

Are there any other possibilities that I can do with the situation? Or other options?

share|improve this question

closed as not a real question by Tom O'Connor, Greg Askew, Scott Pack, mdpc, faker Dec 25 '12 at 10:04

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

This is a terrible idea. If this is server, treat it like a server. – Sven Dec 24 '12 at 12:41
well this is what i can offer to the user at the moment – user1835740 Dec 24 '12 at 13:18
up vote 1 down vote accepted

Mathias suggest the correct action but with incorrect parameters.

Open secpol.msc and navigate to Security Settings - Local Policies - User Rights Assignment:

Find the 'Shut down the system' policy which determines who can shut down the server.

There are two entries in there on a 2008R2 Server: Administators and 'Backup Operators'.

Because you want to keep the user in the administators group, you need to remove that group but add another group or users who should still be able to shut down the server.

The problem with the user still being an administator is that he can just open secpol.msc and just add himself back to the 'Shut down the system' policy.

So you would need to prevent him from using the Local Group Policies, which may be possible but may also break other things he should be able to do as an administrator.

share|improve this answer

Open the Local Security Policy on the machine (Run -> secpol.msc).

Navigate to:

  • Security Settings
  • Local Policies
  • User Rights Assignment

Select Shut down the system.

Remove Users from the list of security principals.

Now, only a member of the local Administrators group can shut down the machine.

share|improve this answer
He specifically asked to prevent an admin from shutting down the system. – Sven Dec 24 '12 at 12:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.