Free tools Windows power users keep installed
One-click scans. No signup required.
Use an Intune Windows Device restrictions profile and set Start > Shut down to Block. This applies the Windows HideShutDown policy, hiding Shut down and Update and shut down from the Start-menu power button on targeted Azure Virtual Desktop (AVD) session hosts. It is a user-interface restriction, not a guarantee that every script, application, administrator, or Azure operation cannot stop the virtual machine.
Important Windows 10 and AVD context
Windows 10 reached its normal end of support on October 14, 2025. The procedure below remains the documented policy method for supported Windows editions and versions, but Windows 10 AVD deployments in 2026 need separate consideration of the applicable Extended Security Updates (ESU), image, and servicing requirements. Microsoft describes AVD-specific ESU scenarios at its AVD ESU documentation.
Intune and AVD are separate management planes. Intune configures the Windows operating system; Azure and AVD control host pools, session hosts, scaling, allocation, and infrastructure power state.
What the policy actually hides
The Start policy hides these entries from the Windows Start-menu power button:
#1 Best Overall
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
- Shut down
- Update and shut down, when Windows presents it
It does not automatically prevent:
- Shutdown started by a script, service, or application.
- An administrator using Windows administrative tools.
- Stopping, restarting, or deallocating the VM through Azure, AVD automation, maintenance, or scaling operations.
- Every power-related control on every Windows screen.
Microsoft also notes that the broader Windows policy called Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands does not stop Windows-based programs from performing those functions: Windows Start policy settings.
Prerequisites
- The session host uses a Windows edition and version supported by the Start Policy CSP. Microsoft lists Windows 10 version 1703 and later editions including Pro, Enterprise, Education, and IoT Enterprise; validate the exact AVD image and edition.
- Each target VM is enrolled in Intune and appears as a managed Windows device. Review Microsoft’s guidance for managing Windows virtual machines with Intune, including image and enrollment considerations.
- The devices resolve into a dedicated Microsoft Entra device group for AVD session hosts.
- You can create and assign Intune configuration profiles.
- No existing Intune, settings-catalog, custom OMA-URI, or Group Policy setting will conflict with the intended value.
Create the Intune configuration profile
- Open the Microsoft Intune admin center.
- Go to Devices > Windows > Configuration profiles.
- Select Create profile.
- Choose Platform: Windows 10 and later.
- Choose Profile type: Templates, then select Device restrictions.
- Name the profile, for example
AVD - Hide Shut Down Option. - Open Start or Start options.
- Set Shut down to Block.
- Leave unrelated settings as Not configured unless this profile is intentionally controlling them.
- Configure scope tags if your organization uses them, review the settings, and assign the profile to the AVD device group.
- Create the profile and allow the session hosts to check in.
Portal labels can change as Microsoft moves settings between templates and other profile experiences. The stable technical control is the Start CSP setting documented in the Windows device restrictions reference.
Rank #2
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
- 4GB DDR4 System Memory; 128GB Solid State Drive
- 11.6" HD (1366 x 768) Multi-Touch Display
- Combo headphone/microphone jack - Noble Wedge Lock slot - HDMI; 2 USB 3.1 Gen 1
- Windows 11 Pro
Choose related power restrictions deliberately
The same Start policy family exposes separate controls. Do not block every option automatically; choose according to the session-host operating model.
| Option | CSP setting | When to consider blocking it |
|---|---|---|
| Shut down | HideShutDown |
Default choice when you want to prevent accidental user shutdown. |
| Sleep | HideSleep |
Useful for a tightly controlled desktop; cloud VMs generally have little need for client-style sleep. |
| Hibernate | HideHibernate |
Usually unnecessary on AVD and can be restricted in kiosk-like designs. |
| Switch account | HideSwitchAccount |
Consider on dedicated or tightly controlled sessions; retain it where shared-device workflows need account switching. |
| Restart | HideRestart |
Usually leave available for Windows Update, remediation, and help-desk recovery. |
| Power button | HidePowerButton |
Removes the Start-menu power button itself, a more aggressive user-interface change. |
The commonly used AVD design blocks shutdown, sleep, hibernate, and account switching while leaving restart and disconnect available. Treat that as a design choice, not a universal requirement.
Recommended Free Tools
Rank #3
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Assign to the correct AVD devices
Use a dedicated device group rather than a broad user assignment when the requirement is specifically about session-host behavior. Pilot with a small set of hosts, exclude physical Windows devices, and confirm that filters and applicability rules include the intended VMs. Assignment status should be reviewed before expanding the scope.
Verify policy application
- In Intune, open the profile and review Device assignment status. Investigate Pending, Conflict, Error, and Not applicable results.
- On a session host, open Settings > Accounts > Access work or school, select the organizational connection, choose Info, and select Sync when available. An administrator can also initiate a sync from the Intune device actions.
- Sign in to that same VM and open the Start-menu power button. The expected result is that Shut down and Update and shut down are absent. A 2024 HTMD walkthrough reported Restart and Disconnect remaining available after its selected restrictions: HTMD’s AVD walkthrough.
- If the Intune report shows success but Explorer still displays the command, sign out or restart the session host to refresh the shell, then test again.
Fallback: deploy the CSP with a custom OMA-URI
If the template does not expose the setting in your tenant, create a custom Windows policy with this device-scoped value:
Rank #4
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
| OMA-URI | ./Device/Vendor/MSFT/Policy/Config/Start/HideShutDown |
|---|---|
| Data type | Integer |
| Value to hide shutdown | 1 |
| Value to restore visibility | 0 |
The setting is device-scoped, so evaluate it as configuration of the AVD VM rather than as an individual user’s preference. The supported policy definition and values are documented in the Start Policy CSP.
Troubleshoot a visible Shut down command
- Confirm the VM is enrolled in the expected Intune tenant.
- Confirm the profile is assigned to the device group that contains that exact session host.
- Check the Windows edition and version against the policy’s support requirements.
- Trigger an Intune sync and allow time for check-in and processing.
- Check for conflicting configuration profiles, settings-catalog entries, custom OMA-URI policies, and Group Policy.
- Verify that Start > Shut down was set to Block, rather than only changing a power-button setting.
- Review Intune diagnostics and local MDM policy results for
./Device/Vendor/MSFT/Policy/Config/Start/HideShutDown = 1. - Sign out or restart to refresh Explorer, then ensure you are testing the same VM shown in Intune.
When another control is the better answer
Need broader Windows command removal
The Group Policy setting Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands also removes power controls from the Start menu, Windows security screen, and sign-in screen. It is not interchangeable with HideShutDown, and it still does not stop programs from invoking shutdown.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- WINDOWS 11 | STABLE PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 system, this laptop delivers stable performance for everyday computing tasks. It supports web browsing, online learning, document editing, email communication, and basic office work with optimized power efficiency, providing a practical and reliable experience for essential daily use for daily use.
- 15.6” FHD IPS DISPLAY: Features a 15.6-inch Full HD IPS display with narrow bezels, offering wider viewing angles and clearer image details compared to standard panels. The improved screen-to-body ratio enhances visual experience for study, reading, document work, and video playback, making it suitable for both productivity and entertainment use.
- 4GB DDR4 + 128GB eMMC STORAGE: Equipped with 4GB DDR4 memory and 128GB eMMC storage for everyday basics such as browsing, documents, email, and online learning platforms. The built-in TF card slot supports storage expansion up to 1TB, giving you more flexibility for files, photos, videos, and daily documents. TF card not included.
- CONNECTIVITY & PORTS: Includes 1× TF card slot, 2× USB 3.2 Gen1 ports, and 2× full-featured Type-C ports (USB 3.2 Gen1). The Type-C ports support data transfer, charging, and video output, enabling flexible connection with external devices such as monitors, storage, and peripherals for daily work and study use.
- LIGHTWEIGHT DESIGN | ONLINE COMMUNICATION: Designed with a slim, portable profile, this laptop is easy to carry for school, commuting, and travel. A built-in 1MP front camera supports online classes, video meetings, remote communication, and everyday conferencing. The 3300mAh battery works with the low-power system design to support practical daily use, while thermal optimization helps maintain quieter operation during extended tasks.
Need to control VM power state or Azure cost
Use AVD scaling plans, scheduled start/stop automation, session limits, and host-pool operations when the objective is availability or consumption control. Hiding a Start-menu command does not reduce Azure billing by itself. AVD infrastructure costs include virtual machines, storage, networking, and profiles; see Azure Virtual Desktop pricing.
Need to change a physical power-button action
The Power Policy CSP configures what a physical power-button press does. That is a different requirement from hiding the Start-menu shutdown command and is usually irrelevant to cloud-hosted AVD sessions.
Considering Windows 365
Windows 365 offers a fixed Cloud PC service rather than a self-operated AVD host-pool architecture. Microsoft says Windows 365 Enterprise requires Windows Enterprise, Intune, and Microsoft Entra ID P1 rights unless included in an eligible suite: Windows 365 FAQ. It is not a direct replacement where pooled desktops, granular host-pool behavior, or Azure-native control are essential.
Recommended default for most AVD deployments
Deploy a device-targeted Intune Device restrictions profile with only Shut down: Block. Keep Restart and Disconnect available unless a documented security or kiosk requirement justifies restricting them. Manage actual VM lifecycle and cost through AVD and Azure operations, and test the policy on the exact Windows image, edition, and multi-session configuration used in production.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
