The system allows shutdown from the logon dialog box.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-1075	3.007	SV-29591r1_rule	ECSC-1	Low

Description
Displaying the shutdown button may allow individuals to shut down a system anonymously. Only authenticated users should be allowed to shut down the system. Preventing display of this button in the logon dialog box, ensures that individuals who shut down the system are authorized and tracked in the systems Security event log.

STIG	Date
Windows 2008 Domain Controller Security Technical Implementation Guide	2012-09-05

Details

Check Text ( C-32716r1_chk )
Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Shutdown: Allow system to be shutdown without having to log on” is not set to “Disabled”, then this is a finding. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: ShutdownWithoutLogon Value Type: REG_DWORD Value: 0

Check Text ( C-32716r1_chk )

Analyze the system using the Security Configuration and Analysis snap-in.
Expand the Security Configuration and Analysis tree view.
Navigate to Local Policies -> Security Options.

If the value for “Shutdown: Allow system to be shutdown without having to log on” is not set to “Disabled”, then this is a finding.

The policy referenced configures the following registry value:

Registry Hive: HKEY_LOCAL_MACHINE
Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\

Value Name: ShutdownWithoutLogon

Value Type: REG_DWORD
Value: 0

Fix Text (F-28803r1_fix)
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> “Shutdown: Allow system to be shutdown without having to log on” to “Disabled”.