For example, the usrmgr.exe file could be renamed to logon.scr. All the initialization and configuration information used by Windows NT is stored in the registry. The Registry Editor supports remote access to the Windows NT registry. When a user connects over the network to the registry, the Server Service on the target computer checks for the existence of the winreg key. If winreg is not present, the connection is allowed.
Hackers can gain remote access to the registry if winreg is missing.
This allows users to log in at the domain controller using the console keyboard, or at a workstation in a workgroup system. For domain controllers, only administrators should have this right. This right should be denied to Everyone and Guests on any type of Windows NT operating system. This allows a user to access the Shut Down option on the Start menu. In a domain system, this applies only to the domain controllers.