Windows 2000 Group Policy Shutdown Script Mechanism

In Microsoft Windows 2000, system shutdown scripts configured via Group Policy are executed by the Windows Logon process (winlogon.exe) in conjunction with the Group Policy Scripts Client-Side Extension (gptext.dll). When a system shutdown sequence begins, the operating system invokes these scripts under the Local System security context before user sessions are fully terminated and system services are stopped. This article details the underlying architecture, execution process, and system components responsible for running shutdown scripts in Windows 2000.

The Role of Winlogon

The Windows Logon process (winlogon.exe) manages interactive logon sessions, user logoffs, and system shutdown events. When a shutdown or restart is initiated, winlogon.exe intercepts the event and determines whether any computer-level policies must be processed before the operating system halts. Because shutdown scripts apply to the computer rather than the user, winlogon.exe handles their execution directly.

The Scripts Client-Side Extension (gptext.dll)

Group Policy relies on Client-Side Extensions (CSEs) to apply specific policy areas. The Scripts extension is handled by the dynamic link library gptext.dll, registered under the following registry path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{42B5FAAE-6536-11d2-AE5A-0000F87571E3}

During policy processing, the Group Policy engine downloads script configurations defined under Computer Configuration\Windows Settings\Scripts (Startup/Shutdown) and writes the script paths and parameters to the local registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System\Scripts\Shutdown

When the shutdown procedure begins, winlogon.exe queries this registry key to locate the designated script files and execution arguments.

Execution Context and Behavior

• Security Context: Shutdown scripts run under the NT AUTHORITY\SYSTEM (Local System) account. This grants the scripts elevated privileges across the local machine, allowing them to manipulate system files, manage local services, and adjust machine configurations.
• Interpreter Invocation: Depending on the file type (such as .bat, .cmd, or .vbs), winlogon.exe invokes the appropriate command interpreter—typically cmd.exe for batch files or Windows Script Host (cscript.exe / wscript.exe) for VBScript and JScript files.
• Execution Order and Timing: By default, Windows 2000 executes shutdown scripts synchronously. Each script must finish before the next one starts, and the system does not finish shutting down until all scripts have completed or the timeout threshold is reached. The default execution timeout is managed by the MaxWaitProcDestruction policy setting (defaulting to 10 minutes / 600 seconds) to prevent frozen scripts from indefinitely hanging the shutdown process.