Giving local user access to psshutdown from SysInternals

From: roberto (bobd_at_hacm.org)
Date: 02/10/05 

Date: 10 Feb 2005 12:48:40 -0800

Running a W2K3 domain with mostly W2KPro clients.

Want to remove user access to the "Shutdown" button via Group Policy to
enforce leaving machines on for off hour patching, defragging,
scanning, etc. Removing "Shutdown," of course, also removes access to
"Restart" - bummer.

We need a way to give users a means to reboot their box in the event it
gets hung for whatever reason. I would like to put a PsShutdown icon
in their start menus or on their desktops. In trying this, I find that
users do not have rights to run that app - even though I have applied
appropriate permissions and have included the app's name in the Policy
that limits acceptable apps in the domain.

How can I go about giving unprivileged uses a pre-configured (with
appropriate switches already applied)icon for PsShutdown.exe?

I can use the Shutdown.exe utility available in the W2K resource kit -
but it doesn't seem to lend itself to being pre-configured for a forced
reboot in xx seconds with a message of "Yadaa yadaa yaddaa." It also
allows users to browse for and shutdown other machines remotely unless
the appropriate policy setting is configured.

Thanks

roberto