Security: The Force shutdown from a remote system user right must only be assigned to the Administrators group

c2f9fe24-d1bc-4980-9e5c-f9ff3c952bf9

Inappropriate granting of user rights can provide system, administrative, and other high-level capabilities.

Accounts with the "Force shutdown from a remote system" user right can remotely shut down a system, which could result in a denial of service.

Remediation

To fix this configure the policy value for
Computer Configuration
|_ Windows Settings
|_ Security Settings
|_ Local Policies
|_ User Rights Assignment
|_ Force shutdown from a remote system to include only the following accounts or groups:
- Administrators CAT II

STIG: Server
2025: https://system32.eventsentry.com/stig/viewer/V-278251
2022: https://system32.eventsentry.com/stig/viewer/V-254501
2019: https://system32.eventsentry.com/stig/viewer/V-205758
2016: https://system32.eventsentry.com/stig/viewer/V-225080

Desktop
W11: https://system32.eventsentry.com/stig/viewer/V-205758
W10: https://system32.eventsentry.com/stig/viewer/V-220974

NIST 800-53 : AC-3, AC-6, CM-6
NIST 800-171: 3.1.1, 3.1.2, 3.4.6
CMMC v2.0 L2: AC.L2-3.1.1, AC.L2-3.1.2, CM.L2-3.4.6
PCI-DSS v4.0: 2.2.1, 7.2.1
HIPAA SR : ยง164.312(a)(1)
HIPAA HICP : Practice 3 (Identity and Access Management)