title: Remote shutdown via api call
body: <p>I recently implemented a web application in C# that provides me an api via which I can restart or shut down my windows server. It's very simple code that just receives an http post request with in the body the action (shutdown or restart) and the password.</p>
  
  <pre><code>[HttpPost]
      public HttpResponseMessage Post([FromBody] SystemActionModel actionRequest)
      {
          if (!Utils.ValidatePassword(actionRequest))
              return new HttpResponseMessage(HttpStatusCode.Unauthorized);
  
          switch (actionRequest.action)
          {
              case "shutdown": 
                  SystemActions.Shutdown(actionRequest);
                  return new HttpResponseMessage(HttpStatusCode.OK);
                  break;
              case "restart": 
                  SystemActions.Restart(actionRequest);
                  return new HttpResponseMessage(HttpStatusCode.OK);
                  break;
              default:
                  return new HttpResponseMessage(HttpStatusCode.NotFound);
          }
      }
  
  
  public class SystemActions
  {
      public static void Shutdown(SystemActionModel actionRequest)
      {
          var psi = new ProcessStartInfo("shutdown", "/s /f /t 0");
          psi.CreateNoWindow = true;
          psi.UseShellExecute = false;
          Process.Start(psi);
      }
  
      public static void Restart(SystemActionModel actionRequest)
      {
          var psi = new ProcessStartInfo("shutdown", "/r /f /t 0");
          psi.CreateNoWindow = true;
          psi.UseShellExecute = false;
          Process.Start(psi);
      }
  }
  </code></pre>
  
  <p>This code works as expected when debugging this locally and sending the http request to localhost. However, when I deploy this web app on my windows server machine, it does not restart or shutdown the machine. I still get the 200 response and the logging shows that the code is called, but the machine itself doesn't restart or shut down.</p>
  
  <p>Does somebody know what could go wrong here? Does the web app need specific rights to do this, or could something else be the origin of this issue?</p>