Re: remote shutdown

From: Torgeir Bakken (MVP) (Torgeir.Bakken-spam@hydro.com)
Date: 02/16/03 

From: "Torgeir Bakken (MVP)" <Torgeir.Bakken-spam@hydro.com>
Date: Sun, 16 Feb 2003 17:57:42 +0100

Tan Fang Wai wrote:

> how come when i try to shut down a XP pc from a host computer using
> shutdown.exe but it keep saiding that access denied

Hi

It could be a ForceGuest issue (set by a registry value). It means that all the
connection coming from "the network" will be authenticated as the Guest User.
For WinXP, the ForceGuest setting is enabled by default when in workgroup mode
(not domain) and gives access problems for WMI connections and shares access,
other DCOM services and RPC services as well.

Note that for WinXP Home you cannot disable the ForceGuest behavior (only in
WinXP Pro).

So if you are running Pro, you could try this:

You can change this registry value without using regedit.exe through these steps
-

1. Open the Local Security Policy console in the Administrative Tools folder.

2. Browse down to: Security Settings\Local Policies\Security Options.

3. Double-click on the Network Access: Sharing And Security Model For Local
Accounts.

4. Change the settings from Guest Only to Classic. This feature is, by default,
set to Classic when Windows XP Professional is joined to a domain.

Using regedit.exe is also possible:

HOWTO: Validate User Credentials on Microsoft Operating Systems
http://support.microsoft.com/default.aspx?scid=KB;EN-US;180548

<quote>
On Windows XP, the ForceGuest registry value is set to 1 by default in the
following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

On a Windows XP computer that is a member of a workgroup:
If ForceGuest is enabled (set to 1), SSPI will always try to log on using the
Guest account.
If the Guest account is enabled, an SSPI logon will succeed as Guest for any
user credentials.
If the Guest account is disabled, an SSPI logon will fail even for valid
credentials.
If ForceGuest is disabled (set to 0), SSPI will log on as the specified user.
</quote> 

--
torgeir
Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and a ONLINE version of the 1328 page
Scripting Guide: http://www.microsoft.com/technet/scriptcenter

Relevant Pages

  • Re: Problem using command-line shutdown to shutdown remote PCs
    ... It could be a ForceGuest issue. ... Validate User Credentials on Microsoft Operating Systems ... If the Guest account is enabled, an SSPI logon will succeed as Guest for any ...
    (microsoft.public.windowsxp.security_admin)
  • Re: remote shutdown
    ... It could be a ForceGuest issue. ... Validate User Credentials on Microsoft Operating Systems ... If the Guest account is enabled, an SSPI logon will succeed as Guest for any ...
    (microsoft.public.windowsxp.security_admin)
  • Re: File sharing
    ... >> The windows firewall is on File and print sharing is on. ... > It could be a ForceGuest issue... ... Validate User Credentials on Microsoft Operating Systems ... > If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Cannot access XP sharing even settings are right
    ... Or it could be a ForceGuest issue as well. ... Note that for Windows XP in a workgroup setting, ... If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)
  • Re: File sharing
    ... > The xp account is an administrator account. ... It could be a ForceGuest issue... ... Note that for Windows XP in a workgroup setting, ... If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)
Quantcast