You need to reboot the system for the changes to take effect after performing one of the following.

Using a graphical user interface

1. Open the Registry Editor (regedit.exe) and connect to the target machine.
2. In the left pane, expand HKEY_LOCAL_MACHINE > SOFTWARE > Policies > Microsoft > Windows NT.
3. If there is no subkey called Reliability, create it by right-clicking Windows NT, selecting New Key, and typing Reliability.
4. Right-click Reliability and select New > DWORD Value.
5. In the right pane, type ShutdownReasonOn and hit enter. Leave the default value set to 0.

You can also disable Shutdown Tracker using group policy. The settings for it are located in Computer Configuration > Administrative Templates > System > Display Shutdown System Tracker.

Using a command-line interface
The following command disables the Shutdown Tracker:

> reg add "\\\HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Reliability" /v
 ShutdownReasonOn /t REG_DWORD /d 0

Using VBScript

' This code disables the Shutdown Tracker from running.
 ' ------ SCRIPT CONFIGURATION ------
 intEnable = 0      ' 0 = disable; 1 = enable screen
 strComputer = "."  ' e.g., rallen-srv01
 ' ------ END CONFIGURATION ---------
 const HKLM = &H80000002
 strKeyPath = "SOFTWARE\Policies\Microsoft\Windows NT\Reliability"
 set objReg = GetObject("winmgmts:\\" & strComputer & _
                        "\root\default:StdRegProv")
 intRC1 = objReg.CreateKey(HKLM,strKeyPath)
 intRC2 = objReg.SetDwordValue(HKLM, strKeyPath, "ShutdownReasonOn", intEnable)
 if intRC1 <> 0 or intRC2 <> 0 then
    WScript.Echo "Error setting registry value: " & intRC
 else
    WScript.Echo "Successfully disabled shutdown tracker"
 end if

Don’t get me wrong, I think the Shutdown Tracker is a very useful feature. In fact, I’m glad Microsoft added it, but it can be annoying on test systems that you want to restart or shut down frequently. After Shutdown Tracker runs, it creates event 1074 in the System event log. Here is an example:

Event Type:    Information
 Event Source:    USER32
 Event Category:    None
 Event ID:    1074
 Date:        10/11/2003
 Time:        6:50:42 PM
 User:        rallen-w2k3\administrator
 Computer:    RALLEN-W2K3
 Description:
 The process Explorer.EXE has initiated the restart of computer RALLEN-W2K3 on behalf
 of user RALLEN-W2K3\Administrator for the following reason: Other (Planned)
  Reason Code: 0x85000000
  Shutdown Type: restart
  Comment: Just installed a hotfix.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/
 events.asp.
 Data:
 0000: 00 00 00 85               ...

You can even customize Shutdown Tracker if you want. You can create your own shutdown reasons. There are eight by default. All it takes is some more registry changes. See MS KB 293814 for more information.

A setting in the registry controls whether this screen is displayed by default. When a user logs on for the first time, the subkeys and values in the HKEY_USERS\.DEFAULT key are copied to HKEY_USERS\, which is the same as HKEY_CURRENT_USER for the currently logged on user. Under the .DEFAULT key, the Software\Microsoft\Windows NT\CurrentVersion\srvWiz value dictates if the Configure/Manage Your Server screen displays at logon. A value of 0 disables the screen from displaying and 1 enables it. If you set it to 0 before any user logs on to the system, that screen will never display.

Using a graphical user interface

The following directions disable the screen for the currently logged on user only. See the command-line solution for how to disable it for all users by default.

For Windows Server 2003:

1. From the Start menu, select All Programs Administrative Tools Manage Your Server.
2. At the bottom lefthand corner of the screen, check the box beside Don’t display this page at logon.

For Windows 2000:

1. From the Start menu, select Programs Administrative Tools Configure Your Server.
2. At the bottom of the screen, uncheck the box beside Show this screen at startup.

Using a command-line interface

Run the following command against a Windows Server 2003 or Windows 2000 machine to prevent the Manage/Configure Your Server screen from displaying for all users:

> reg add "\\\HKU\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\
 Setup\Welcome" /v srvwiz /t REG_DWORD /d 0

If a user logged in before you set the previous registry value, then you’ll need to run this command to disable it for the logged-in user (note: this command must be run locally):

> reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Setup\Welcome\srvWiz"
 /ve /t REG_DWORD /d 0

Using VBScript

' This code disables the
  Manage/Configure Your Server screen for all users
 ' (this only applies to users that have not logged in yet)
 ' ------ SCRIPT CONFIGURATION ------
 intEnable = 0                 ' 0 = disable screen; 1 = enable screen
 strComputer = ""  ' name of target server
 ' ------ END CONFIGURATION ---------
 const HKU   = &H80000003
 strKeyPath  = ".DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\" & _
               "Setup\Welcome"
 strValue = "srvwiz"
 set objReg = GetObject("winmgmts:\\" & strComputer & _
                        "\root\default:StdRegProv")
 intRC = objReg.SetDwordValue(HKU, strKeyPath, strValue, intEnable)
 if intRC <> 0 then
    WScript.Echo "Error setting registry value: " & intRC
 else
    WScript.Echo "Successfully disabled screen"
 end if

' This code disables the Manage/Configure Your Server screen for
 ' the currently logged on user.
 ' ------ SCRIPT CONFIGURATION ------
 intEnable = 0   ' 0 = disable screen; 1 = enable screen
 strComputer = "."
 ' ------ END CONFIGURATION ---------
 const HKCU   = &H80000001
 strKeyPath   = "Software\Microsoft\Windows NT\CurrentVersion\" & _
               "Setup\Welcome\srvWiz"
 set objReg = GetObject("winmgmts:\\" & strComputer & _
                        "\root\default:StdRegProv")
 intRC = objReg.SetDwordValue(HKCU, strKeyPath, "", intEnable)
 if intRC <> 0 then
    WScript.Echo "Error setting registry value: " & intRC
 else
    WScript.Echo "Successfully disabled screen"
 end if

1. Open the Group Policy Management Console.
2. In the left pane, navigate to the GPO you want to modify.
3. Right-click the target GPO and select Edit.
4. In the left pane of the Group Policy Object Editor, expand User Configuration Administrative Templates Start menu and Taskbar.
5. In the right pane, double-click Remove links and access to Windows Update (for Windows Server 2003) or Disable and Remove Links to Windows Update (for Windows 2000).
6. Select Enable and click OK.

Using a command-line interface

To disable Windows Update for all users who haven’t logged in previously, run the following command:

> reg add HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /t

REG_DWORD /v NoWindowsUpdate /d 1

To disable Windows Update for the user who is currently logged on, run the following command:

> reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /t REG_

DWORD /v NoWindowsUpdate /d 1

Using VBScript

' This code disables Windows Update in the .Default profile.

' ------ SCRIPT CONFIGURATION ------

strComputer = "."

' ------ END CONFIGURATION ---------

const HKEY_USERS = &H80000003

strKey = ".DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"

set objReg=GetObject("winmgmts:\\" & strComputer & "\root\default:StdRegProv")

objReg.SetDwordValue HKEY_USERS, strKey, "NoWindowsUpdate", 1

WScript.Echo "Windows Update disabled in .Default profile"

If you are using SUS or some other patch management system to distribute updates to your client-base, you may not want your clients accessing the Microsoft Windows Update site (http://windowsupdate.microsoft.com/). One of the reasons to use something like SUS is so your users don’t have to download the same updates over the Internet from Microsoft. If you leave Windows Update turned on, there is nothing to prevent them from doing it.

Fortunately, there is an easy way to disable it. You can use Group Policy to force the change to apply across a group of users (the Windows Update disablement settings are available only in the User Configuration section of a GPO). Or you can use the command-line or VBScript solutions to disable it via a login script or manually if need be.

Once this setting is in effect, a user will not see the Windows Update link in the Start Menu or Internet Explorer, and if the user attempts to access the Windows Update site, he will get a message indicating that Windows Update has been disabled for his computer.

1. From the Control Panel open the Network Connections applet.
2. Right-click the network connection you want to disable and select Disable.

Using a command-line interface

You would think that it would be straightforward to disable a connection from the command line, but unfortunately that is not the case. In fact, the netsh command supports disabling connections, but only non-LAN interfaces, which is very disappointing.

But all is not lost! There is an alternative if you really must have a way to disable connections from the command line. The devcon.exe tool is the command-line alternative to the Device Manager interface and comes with the Driver Development Kit (DDK). You can download it separately by viewing MS KB 311272 (http://support.microsoft.com/default.aspx?scid=311272).

Once you have it downloaded, run this command to get a list of all network devices:

> devcon listclass net

This displays the list of devices in two columns. The left column contains the hardware ID for each device and the right column contains the description for the device.

After you’ve found the device you want to disable, run the following command:

> devcon disable =net <HardwareID>

For example:

> devcon disable =net PCI\VEN_14B9^&DEV_A504^&SUBSYS_500014B9^&REV_00

There are a couple of important things I need to point out. First, if the hardware ID contains any ampersands (&), you have to escape them using a caret (^). Otherwise, the CMD session will interpret everything after the first & as another command and devcon will attempt to match any hardware ID that matches the string up until the first &. This can be dangerous because it can cause you to disable devices you didn’t intend to.

Second, if the hardware ID contains two backslashes, remove the second backslash and everything following it. For example, if the listall command returned this for a device I wanted to disable:

PCI\VEN_14B9&DEV_A504&SUBSYS_500014B9&REV_00\4&39A85202&0&10F0: Cisco Systems PC I Wireless LAN Adapter

I would need to use this as the hardware ID (including the carets):

PCI\VEN_14B9^&DEV_A504^&SUBSYS_500014B9^&REV_00

Many servers these days come with two network adapters installed to avoid a single point of failure with the network connection. Generally, keep one connection active and use the other as a back up. There are a couple of ways to do this. One is to simply disable one of the connections and manually enable it if the primary fails. Since you probably won’t have network connectivity after the primary adapter fails, you’ll need another way to access the server, such as an out-of-band console connection of some type.

Another way to do this is to use a feature that many hardware vendors support called teaming. With teaming, both adapters are used to form a virtual adapter. If the primary adapter becomes unavailable, the backup takes over automatically. (See your hardware vendor for more details.) The problem with teaming is that, depending on the implementation, it can be unreliable and ultimately cause more configuration headaches than it is worth. I recommend testing teaming configurations thoroughly before implementing them in production.

# passwd -l aborg

Password changed.

To re-enable, or unlock, a user’s password use:

# passwd -u aborg

Password changed.

Another way to disable an account is to insert an exclamation point at the beginning of the password field in /etc/shadow:

foobar:!$1$wiDlQr34$mitGZA76MSYCY04AHIY1:12466:0:99999:7:::

Yet another way is replace the x in the password field in /etc/passwd with an asterisk (*):

foober:*:1025:1025:Foober Smith,,,:/home/foober:/bin/bash

You can also take away the user’s login shell:

# usermod -s /bin/false foober

But it’s best to stick with passwd -l and -u.