If shutdown /m returns Access is denied, the target computer has authenticated your connection but has not authorized that account to shut down Windows remotely. Grant the Force shutdown from a remote system user right (SeRemoteShutdownPrivilege) on the target, account for Group Policy that may overwrite the setting, and check UAC remote-token filtering when you use a local account. Then run the command again with the correct target and credentials.
What “Access is denied” means for remote shutdown
Remote shutdown is an authorization operation on the computer you want to restart or power off. The account issuing the command must have a specific user right on that target: Force shutdown from a remote system, identified internally as SeRemoteShutdownPrivilege. Windows normally grants this right to Administrators, but an administrator group membership alone may not be enough if a policy removes the right or a remote logon receives a filtered token.
As an Amazon Associate I earn from qualifying purchases.
This is why you can sometimes browse a shared folder, use remote administration tools, or authenticate successfully and still be unable to restart the machine. Those activities use different permissions. Network connectivity proves that the computers can communicate; it does not grant the shutdown privilege.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Before changing anything: identify the account and target
Confirm the exact computer
Use the target’s current computer name or IP address and make sure it resolves to the intended device. A typo, stale DNS entry, or duplicate name can make you troubleshoot the wrong machine. In Command Prompt, you can check the name resolution and basic reachability before changing security policy:
#1 Best Overall
ping COMPUTERNAME
A failed ping is not conclusive because firewalls may block ICMP, but an unexpected address is a reason to stop and verify the target. The shutdown command’s remote switch uses two backslashes before the computer name:
shutdown /m \COMPUTERNAME /r /t 0Determine whether you are using a domain or local account
- A domain account normally appears as
DOMAINusernameand is governed by domain and organizational-unit policy. - A local account appears as
COMPUTERNAMEusername(or sometimes.username) and is subject to local-account UAC token filtering when it connects over the network.
Use an account that is an administrator on the target, or a deliberately delegated account or group that has the remote-shutdown right. Do not assume that being an administrator on your own computer grants any authority on another computer.
Fix 1: grant “Force shutdown from a remote system” on the target
This is the primary fix. Perform the change while signed in to the target with an account allowed to edit its security policy, or make the equivalent change in the Group Policy that governs the target.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- On the target computer, press Win+R, type
secpol.msc, and press Enter. (Windows Home editions may not include the Local Security Policy console; use the governing domain policy or an edition that provides the console.) - Open Local Policies, then User Rights Assignment.
- Open Force shutdown from a remote system.
- Select Add User or Group, enter the intended domain account, local account, or tightly scoped administrative group, and confirm the name.
- Apply the change and close the policy console. Sign out and back in, or otherwise establish a fresh administrative session, before testing.
Grant the right only to accounts that genuinely need it. Anyone who has it can intentionally shut down the computer, creating a denial-of-service condition. A dedicated administrative group is easier to review than adding many individual accounts, and removing an account from that group withdraws the delegated right without changing unrelated administrator settings.
Use the domain policy when the target is centrally managed
For a domain-joined computer, open the Group Policy Object that applies to the target and navigate to:
Rank #2
Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Force shutdown from a remote systemAdd the approved domain group or account there. Editing a workstation’s local policy may appear to work temporarily, but a domain policy can replace it at the next policy refresh.
Fix 2: check Group Policy precedence and overwritten settings
If the setting is greyed out, the account disappears after a refresh, or the change keeps reverting, a higher-level policy controls it. Windows applies policy in this order:
Free tools Windows power users keep installed
One-click scans. No signup required.
| Policy level | What it means for this setting |
|---|---|
| Local computer policy | The setting configured directly on the target. |
| Site policy | Can overwrite the local value for computers in that site. |
| Domain policy | Can overwrite local and site results for domain members. |
| Organizational unit (OU) policy | The applicable OU policy has the highest precedence among these levels and can replace earlier values. |
Ask the administrator responsible for the target’s site, domain, or OU to inspect the effective policy. On the target, you can generate a policy report with:
gpresult /h %USERPROFILE%Desktopgpresult.htmlOpen the resulting report and look under Computer Details for the applied User Rights Assignment settings and the Group Policy Objects that supplied them. After an authorized policy change, refresh policy with:
gpupdate /forceIf the right is still absent, the effective policy—not the local console—is the configuration that must be corrected. Do not fight the domain policy by repeatedly editing the registry or local policy; that creates an inconsistent and difficult-to-audit setup.
Fix 3: address UAC remote-token filtering for local accounts
Local administrator credentials have an additional restriction when used over the network. User Account Control (UAC) normally gives a local account a filtered token for remote connections. The account can authenticate and still lack the elevated token expected by remote administrative operations, including shutdown.
Prefer a domain account or narrow delegation
In a managed environment, the safer design is to use a domain account or group and grant only the required right through policy. This preserves centralized auditing and avoids disabling the UAC protection applied to local administrators. In a workgroup, first confirm that the local-account arrangement is genuinely required and that the target is controlled and trusted.
Review the registry value only for a controlled workgroup scenario
Microsoft documents the value LocalAccountTokenFilterPolicy under:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemThe default behavior is value 0, which keeps remote local-administrator connections filtered. A DWORD value of 1 causes affected local administrators to receive an elevated remote token and disables the UAC remote restrictions for them. That is a broad security change, not a harmless permission toggle.
- On the target, create a system-state backup or export the
Systemregistry key so you can restore the previous configuration. - Open
regedit.exeas an administrator and browse to the path above. - Find
LocalAccountTokenFilterPolicy. If it does not exist, create a DWORD (32-bit) Value with that exact name. - Set its value to
1only if your security design accepts elevated remote local-admin tokens. - Close Registry Editor and test with the intended local account. If the change is not needed, return the value to
0(or remove the value to restore the default behavior) and retest.
Do not use this registry change as a substitute for granting the correct user right. The account still needs Force shutdown from a remote system, and a domain or OU policy can impose its own settings. Because value 1 weakens UAC’s remote restriction for affected users, limit the change to a narrowly controlled workgroup or administrative design.
Run the remote shutdown command correctly
The built-in shutdown command supports a remote computer and a restart or power-off action. Microsoft’s command reference, dated May 1, 2025, states that the caller must have the appropriate shutdown user right on a local or remotely administered computer.
Immediate restart
shutdown /m \COMPUTERNAME /r /t 0Immediate shutdown
shutdown /m \COMPUTERNAME /s /t 0Restart with a warning and comment
shutdown /m \COMPUTERNAME /r /t 60 /c "Planned maintenance"/m identifies the remote computer, /r restarts it, /s powers it off, and /t sets the delay in seconds. A zero-second timeout starts the action immediately, so save work on the target first. A nonzero timeout gives logged-on users time to save files. Use the target’s real name; a command aimed at the wrong machine can still be fully authorized and disruptive.
If access is still denied: diagnose in the right order
1. Prove that the account is recognized by the target
Check the account format and credentials used for the connection. A domain account must be able to contact the domain, while a local account must exist on the target with the expected password. If multiple stored credentials are present, remove stale entries from Windows Credential Manager and retry with the intended identity.
2. Verify that the right is effective, not merely configured locally
Use the local security policy console or the Group Policy Results report to confirm that the account or group appears in the effective Force shutdown from a remote system assignment. If it is missing after gpupdate /force, find the higher-level policy that removes or replaces it.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →3. Check name resolution and reachability
Try the fully qualified computer name or the target’s verified IP address when appropriate. Confirm that the target is powered on and connected to the same reachable network path. A network failure usually produces a different error than an authorization failure, but both should be eliminated before further policy changes.
4. Review firewall and remote-management rules
Windows firewall or an organization’s network policy may block the remote-management traffic needed by the shutdown request. Confirm that the target’s approved firewall profile and remote-management rules permit the operation. Do not broadly disable the firewall as a test; have the administrator enable only the required, documented rules.
5. Consider endpoint security and maintenance state
Security software, maintenance windows, or another management system may intentionally block remote shutdowns. Check the target’s event logs and the organization’s change-control rules before forcing a restart. If a management platform owns the device, use its approved restart workflow rather than bypassing it.
6. Test with a controlled delay
After correcting authorization and connectivity, use a short warning period rather than an immediate restart:
Recommended Free Tools
shutdown /m \COMPUTERNAME /r /t 60 /c "Administrative test"If the command succeeds, cancel it during the 60-second window with:
shutdown /m \COMPUTERNAME /aCancellation also requires the appropriate authority. Use this test only when you can safely leave the target running if cancellation fails.
Choosing the right remediation
| Situation | Preferred approach | Security and administration trade-off |
|---|---|---|
| Domain-joined computer | Delegate the right to a narrowly scoped domain group through the applicable GPO. | Centralized, auditable, and consistent; requires access to domain policy administration. |
| One-off local policy on a standalone computer | Add the approved local account or group in secpol.msc. |
Simple for a single target, but changes must be tracked manually and can differ across machines. |
| Workgroup using a local administrator | Grant the right, then review token filtering; use LocalAccountTokenFilterPolicy=1 only when the controlled design requires it. |
May enable the operation, but removes UAC remote restrictions for affected local administrators and broadens exposure. |
| Setting keeps reverting | Find and change the site, domain, or OU GPO that supplies the effective value. | Requires the policy owner; repeated local edits will not persist. |
How to undo the changes safely
- Remove an account or group from Force shutdown from a remote system when the delegation is no longer needed.
- For a registry-based workaround, restore
LocalAccountTokenFilterPolicyto0or remove the value to return to the default filtered behavior. - Refresh Group Policy and confirm the effective assignment with a policy report.
- Retest with a nonprivileged account to ensure that unauthorized users receive an access error while the approved administrative workflow still works.
Keep a record of who received the right, which computer or OU it applies to, and why. Remote shutdown is powerful enough that an undocumented broad grant can become an operational and security problem later.
If you want an optional shortcut after trying the manual checks, Outbyte PC Repair can address common Windows issues, adjust resource-heavy settings, clean temporary and cache files, check certain Windows vulnerabilities, and provide an app-crash log. It runs on Windows 11, 10, 8, and 7; its free trial is offered by category for at least two days before a paid subscription. It complements antivirus software rather than replacing it, and results vary—no tool repairs every remote-shutdown failure.
The Bottom Line
The durable fix is to authorize the correct account on the target: grant Force shutdown from a remote system through the effective local or domain policy, then address UAC token filtering only when a controlled workgroup design requires it. Verify policy precedence, credentials, connectivity, and firewall rules before retrying shutdown /m.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
