Consider the following scenario:
- The machine on which the user is logging on, has been rebooted.
- The end user is the first user that logs on to the machine after this reboot.
- Managed Application Security is enabled.
In this scenario, the user will get a warning message that "shutdown.exe" is blocked upon logging in to the session.
A forced reboot of Microsoft Windows invokes the Microsoft Windows Shutdown Event Tracker:
The process for the Shutdown Event Tracker is "shutdown.exe" and this was blocked.
Create a GPO that disables the Microsoft Windows Shutdown Event Tracker.
This setting can be found under: Computer Configuration > Administrative Templates > System > Display Shutdown Event Tracker.