Pay2Key Disabling Windows Shutdown via shutdownwithoutlogon Registry Key

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

This rule detects modifications to the Windows Registry that enable the 'Shutdown without logon' feature, which allows a user to initiate a system shutdown without needing to log in first. This setting is often modified by attackers or during unauthorized system reconfiguration to weaken access control or facilitate disruptive activities.