Remote Shutdown in Windows 11 and 10: Command, PowerShell

The Windows remote shutdown command is the same shutdown command you use locally, pointed at another machine. To shut down or restart another Windows PC from yours, open an administrator Command Prompt and run shutdown /s /m \\COMPUTERNAME /t 60 /c "Maintenance" for a shutdown, or shutdown /r /m \\COMPUTERNAME /t 60 for a restart; the graphical version is shutdown /i. In PowerShell it is Restart-Computer -ComputerName NAME -Force or Stop-Computer. All of them need three things on the target: your account must be an administrator there, the Remote Shutdown and File and Printer Sharing firewall rule groups must be open, and, if the PCs are not in a domain, a single registry value that the "Access is denied (5)" error is really about. That last one is the part no ten-year-old tutorial mentions, including the first version of this page: on a home or workgroup network, Windows deliberately strips administrator rights from local accounts connecting over the network, so the command fails even with the right password until you tell Windows otherwise. This guide covers remote shutdown on Windows 11, Windows 10 and Windows Server by every method (the command line, PowerShell, the Remote Shutdown dialog, Task Scheduler and Intune), every switch that matters, how to enable remote shutdown on the target with the firewall and permission setup, the access-denied fix, how to cancel a shutdown, how to wake a PC back up, and how to do all of it across a company.

The old version of this page began with "more and more people are asking me how to shut down other people's PCs for fun," and then told them how. That was 2016 and we are not that blog anymore. Jake got the modern version of the question from a customer who runs a six-PC accounts office: the last person out never shuts the machines down, the electricity bill shows it, and the owner wanted to turn them off from her own desk at six. Jake tried the command he remembered, typed her password correctly, and got "Access is denied (5)" on every machine. Ethan's diagnosis took one question: "Are they on a domain?" They were not. "Then Windows is doing exactly what it's designed to do: it won't let a local admin be an admin over the network. There's one switch for that, and it comes with a warning." Here is the whole thing, warning included.

One framing before the commands. A remote shutdown is not a trick; it is an ordinary administrative action that Windows exposes on purpose, with an audit trail, a user right that controls it, and a firewall rule group named after it. Everything below works because you are an administrator of the target machine. If you are not, none of it works, by design, and the right question is not "how do I get around that" but "who administers this machine."

The shutdown command: every switch that matters for remote use

The shutdown command has been in Windows for decades and still does the job on Windows 11, Windows 10 and every supported Windows Server. Run it from an administrator Command Prompt; for a remote target, use the name of the computer or its IP address after /m \\. The full form is:

shutdown [/i | /l | /s | /sg | /r | /g | /a | /p | /h | /e | /o] [/hybrid] [/fw] [/f] [/m \\computer] [/t xxx] [/d [p|u:]xx:yy] [/c "comment"]

A few examples that cover most real needs, all run from your own PC against a machine called ACCOUNTS-03:

:: Shut down in 60 seconds with a message the user sees
shutdown /s /m \\ACCOUNTS-03 /t 60 /c "Office closing. Save your work." /d p:0:0

:: Restart now, forcing apps closed, logged as planned application maintenance
shutdown /r /m \\ACCOUNTS-03 /t 0 /f /d p:4:1

:: Changed your mind during the countdown
shutdown /a /m \\ACCOUNTS-03

:: Restart into the UEFI firmware screen (handy before a BIOS change over remote hands)
shutdown /r /fw /m \\ACCOUNTS-03 /t 0

Two habits from Microsoft's own remarks. Use /d with p: for planned work so the event log records why; without it the shutdown is logged with no reason. And remember that any /t above zero forces apps closed when the timer expires, so the message in /c is the user's only warning; give them a minute, not five seconds.

The Remote Shutdown dialog: shutdown /i

If you prefer a window, shutdown /i opens the Remote Shutdown dialog. Choose Add and type the target computer's name or IP address (several at once is fine), pick Shutdown or Restart from the list, leave Warn users of the action checked and set the seconds, choose a reason from the Shutdown Event Tracker list (select Other (Planned) to type your own comment), and choose OK. It sends the same request as the command, with the same requirements, so if the command gives access denied, so will the dialog. If you need the target's address, our guide to finding a PC's IP address is the two-minute version; on a home network, the computer name usually works and is more stable than an address the router may reassign.

PowerShell: Restart-Computer and Stop-Computer

PowerShell's cmdlets do the same job with better ergonomics for more than one machine. They use WMI's Win32Shutdown method on the target, need the shutdown privilege there, and do not require PowerShell remoting to be set up; the -ComputerName parameter works even if the target is not configured for remote commands.

# One machine, forced
Restart-Computer -ComputerName ACCOUNTS-03 -Force

# Every machine in a text file, with a different account
$names = Get-Content C:\office-pcs.txt
$cred  = Get-Credential
Stop-Computer -ComputerName $names -Credential $cred -Force

# Restart and wait until PowerShell is reachable again (max 5 minutes, poll every 2 s)
Restart-Computer -ComputerName ACCOUNTS-03 -Wait -For PowerShell -Timeout 300 -Delay 2

# Preview without doing it
Restart-Computer -ComputerName ACCOUNTS-03 -WhatIf

Three useful details. -Wait with -For (WMI, WinRM or PowerShell) turns a restart into a step in a script that continues only when the machine is back, which is what patch scripts want. -WsmanAuthentication Kerberos is the right choice in a domain; avoid CredSSP because it hands your credentials to the remote machine. And -Force is the equivalent of /f: without it, a signed-in user with unsaved work can block the restart.

"Access is denied (5)": the three causes, in order

This is the error nearly everyone hits first, and the tutorials that say "just run as administrator" are answering the wrong question. Your Command Prompt being elevated on your PC is irrelevant; what matters is your rights on the target. Work through these in order.

1. The user right on the target. Remote shutdown is governed by a specific Windows privilege, Force shutdown from a remote system (SeRemoteShutdownPrivilege), assigned by default to the Administrators group on every Windows machine, and also to Server Operators on domain controllers. Your account must hold it on the target, which in practice means being a member of the target's local Administrators group, either directly or through a domain group. The right is set on the machine being shut down, under Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment, and takes effect at the next sign-in.

2. UAC remote restrictions on a workgroup. This is the one that produced Jake's error. When a machine is not joined to a domain, Windows applies "UAC remote restrictions": a local account that is an administrator on the target gets a filtered, standard-user token when it connects over the network, so it cannot do administrative work remotely, including shutdown. The password is right, the account is an admin, and the answer is still no. Domain accounts are not filtered. To allow full administrative tokens for local accounts over the network, set this value on the target machine, in an administrator Command Prompt there (or once through a script), and no restart is needed:

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Read the trade before you run it. That value exists to stop malware on one PC from using a local administrator password to take over every other PC on the network that shares it. Setting it to 1 removes that protection on that machine for every local administrator account. On a small office network it is a defensible choice if the admin accounts have long, unique passwords and you know which machines carry it; on anything larger, the proper fix is a domain or Microsoft Entra join, where domain accounts are never filtered and the value stays at its default. Our UAC guide covers the wider picture. The built-in Administrator account is exempt from the filter, but it is disabled by default and should stay that way.

3. The firewall on the target. The shutdown request travels over RPC through the file-sharing port (TCP 445), and Windows Defender Firewall ships with a rule group named exactly for it, off by default on Private networks and always off on Public. On the target, in an administrator prompt:

netsh advfirewall firewall set rule group="Remote Shutdown" new enable=yes
netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=yes
:: For Restart-Computer and Stop-Computer (WMI), also:
netsh advfirewall firewall set rule group="Windows Management Instrumentation (WMI)" new enable=yes

If the target's network is set to Public, change it to Private first (Settings > Network & internet > the connection > Network profile type); the rules above are scoped to private and domain profiles, and Windows will not open them on a network it considers untrusted. A different error tells you the firewall is the problem: "The network path was not found (53)" or "The RPC server is unavailable (1722)" mean the request never reached the shutdown service, whereas Access is denied (5) means it reached it and was refused, which points back to causes 1 and 2.

One more cause worth a line, because it wastes hours: the name does not resolve. If ping ACCOUNTS-03 fails while the IP address works, use the address, or fix name resolution; the shutdown command is not the problem.

How to enable remote shutdown on a PC: the checklist

1. Make sure the account you will use is a member of Administrators on the target.
2. Set the target's network profile to Private (or join it to the domain).
3. Enable the Remote Shutdown and File and Printer Sharing firewall groups; add WMI if you will use PowerShell.
4. On a workgroup machine, set LocalAccountTokenFilterPolicy to 1, having read the trade above.
5. Test from your PC with a harmless countdown and cancel it: shutdown /r /m \\TARGET /t 120 /c "Test", then shutdown /a /m \\TARGET.
6. Check the target's event log for the record (next section), so you know the audit trail works before you rely on it.

The other errors, and what each one means

From a Remote Desktop session, from Linux, or from a phone

Inside a Remote Desktop session, the Start menu's power button hides Shut down and Restart on purpose, so that a remote user does not take a server down by habit. The shutdown command is still there: open a Command Prompt in the session and run shutdown /s /t 0 or shutdown /r /t 0, or press Alt + F4 on the remote desktop background to get the full shutdown dialog. Your session ends when the machine goes down, which is expected; if it is a server, connect again once event 1074 says it is back. If Remote Desktop itself will not connect, that is a different problem, covered in our guide to Remote Desktop not working.

From Linux or a Mac, the same RPC request can be sent with Samba's net tool: net rpc shutdown -I 192.168.1.20 -U admin -t 60 -C "Maintenance" shuts the Windows machine down, with -r for a restart and net rpc abortshutdown to cancel. It needs the same three things on the Windows side: an administrator account, the firewall groups, and the token-filter value on a workgroup PC. Alternatively, run ssh to a Windows 11 machine with the OpenSSH server enabled and type the ordinary shutdown /s /t 0 there.

From a phone, there is no built-in Windows feature, and the app-store tools that offer it are doing one of two things: sending a Wake-on-LAN magic packet (which is fine) or running a small agent on the PC that listens for a command over the network, which is a service you are installing with administrator rights and should choose carefully. The safer pattern for a home network is a scheduled task on the PC, or a Remote Desktop app on the phone and the command above.

How to see who shut a PC down: Event Viewer

Every shutdown, local or remote, leaves a record in the target's System log. Open Event Viewer (Win + R, eventvwr.msc), go to Windows Logs > System, and filter on these IDs:

• 1074: a shutdown or restart was initiated, with the process, the user, the reason code and your /c comment. For a remote shutdown it names the remote user.
• 1076: the reason a user gave after an unexpected shutdown, through the Shutdown Event Tracker.
• 6008: the previous shutdown was unexpected, which is the power-cut or crash signature, not a remote command.

The reason codes from /d are what make 1074 useful at scale: a filter for p:4:1 finds every planned application-maintenance restart, and a run of unplanned entries with no reason finds the admin who never types /d. Servers can be made to demand a reason at every shutdown by enabling the Display Shutdown Event Tracker policy under Computer Configuration > Administrative Templates > System.

Shutting down on a schedule instead of on demand

Jake's customer did not actually want to sit at her desk at six; she wanted the machines off at six. That is a scheduled task on each PC, not a remote command: Task Scheduler runs shutdown /s /t 300 /c "Office closing" at 18:00, which gives anyone still working five minutes and a message. Our guide to shutting down on a timer with Task Scheduler has the click-by-click version. Two refinements from the field: create the task with Run whether user is logged on or not so it fires from the lock screen, and if the office worries about pending updates, note that a scheduled shutdown /s does not install them; the separate options are in our guide to shutting down without installing updates. A remote command is for the exception, the machine someone forgot; the schedule is for the rule.

Turning a PC back on: Wake-on-LAN

Shutting down remotely is only half useful if you must walk over to press the power button in the morning. Wake-on-LAN sends a "magic packet" to a machine's network card, which powers the PC up. It needs three things, and the third is the one that catches Windows 11 users.

1. Firmware: in the PC's UEFI or BIOS setup, enable Wake-on-LAN (names vary: "Wake on LAN," "Power on by PCI-E," "Resume by LAN") and disable any deep power-saving mode such as "ErP Ready," which cuts power to the network card entirely.
2. The adapter: in Device Manager, open the wired adapter's Properties. On the Advanced tab enable Wake on Magic Packet; on the Power Management tab check Allow this device to wake the computer and Only allow a magic packet to wake the computer. Confirm with powercfg /devicequery wake_armed, which should list the adapter; if it appears under wake_programmable but not wake_armed, arm it with powercfg /deviceenablewake "adapter name".
3. Fast Startup off. Windows 10 and 11 shut down into a hybrid hibernation state by default, and Windows does not arm the adapter for wake from that state. Turn Fast Startup off (Control Panel > Power Options > Choose what the power buttons do > Change settings that are currently unavailable) or shut down with shutdown /s /t 0 rather than /hybrid; a full shutdown leaves the card listening.

Then send the packet from any WoL tool or a short PowerShell function using the target's MAC address (from ipconfig /all on the target, or getmac /s TARGET from your PC). Wake-on-LAN works on wired Ethernet within the same network; waking over Wi-Fi is supported by few adapters, and waking across the internet needs router configuration that is beyond this page.

For IT admins: fleet restarts by GPO, PowerShell, PsShutdown and Intune

• Prepare the fleet once, by policy. A GPO on the workstation OU: enable the Remote Shutdown and WMI predefined firewall rules under Computer Configuration > Policies > Windows Settings > Security Settings > Windows Defender Firewall; leave Force shutdown from a remote system at Administrators, or add a help-desk group if operators need it without full admin; and keep LocalAccountTokenFilterPolicy at its default, because domain accounts are never filtered and the value only weakens local-account security.
• Batch with PowerShell, not a loop of shutdown. Restart-Computer takes an array, runs in parallel, and -Wait -For WinRM lets a patch script continue only when each machine is back. Log the result of each with -ErrorVariable so the two that were off are a list, not a mystery.
• PsShutdown from Sysinternals adds what shutdown lacks: hibernate, lock, and log off on a remote machine, and it authenticates with explicit credentials on the command line, which is handy on mixed workgroup networks. Same firewall and rights requirements.
• Intune: cloud-managed devices need none of the above. In the Intune admin center, Devices > All devices > select the device > Remote actions > Restart; the device restarts within about five minutes and, on Windows, tries to show "Your device administrator has scheduled a reboot." Shut down is a separate action beside it. Both depend on the device receiving a push notification through Windows Notification Services, so an offline device restarts when it next connects, and the operator needs the Help Desk Operator, Endpoint Security Manager or a custom role with the Remote tasks/Reboot now permission. The same action is available through the Graph API's rebootNow.
• Servers: prefer Restart-Computer -Wait in maintenance scripts, always with /d p: reason codes or their PowerShell equivalent in the log, and never /f against a database or file server without stopping the services first; a forced restart mid-write is how you meet the recovery guide.
• Audit: collect event 1074 centrally. Who restarted the file server at 14:02 on a Tuesday is a question you will be asked, and the answer is already in the log.

The accounts office now has a scheduled shutdown at six on every machine and a one-line command on the owner's desktop for the stragglers, and the electricity bill noticed. Jake's lesson from the afternoon was not the command, which he already knew, but the reason it failed: Windows was protecting the office from exactly the kind of network-wide administrator access he was asking for, and the fix was a decision, not a trick. Make that decision on purpose, open only the rules you need, and read event 1074 once so you know the trail is there.

Revision note. This guide was first published in August 2016 as a short shutdown /i walkthrough. It was rewritten on September 29, 2026 for Windows 11, Windows 10 and Windows Server from Microsoft's shutdown command reference, the Restart-Computer documentation, the Force shutdown from a remote system policy reference, the UAC remote restrictions article and the Intune remote actions documentation, adding the PowerShell methods, the access-denied causes, firewall setup, event logging, scheduling, Wake-on-LAN and an IT admin section. The original's framing of shutting down other people's PCs for fun was removed.