On a Windows device, examine registry event logs for modifications under the System policies path. Determine which registry value name was altered to disable the shutdown button at login.

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey contains @"Policies\System"
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, ActionType

DeviceRegistryEvents
| where tolower(RegistryKey) has @"policies\system"
| where ActionType in ("SetValue", "ModifyValue", "ValueModified", "RegistryValueSet")
| where tolower(RegistryValueName) == "shutdownwithoutlogon"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, ActionType

DeviceRegistryEvents
| where ActionType in ("RegistryValueSet", "RegistryValueModified")
// System policies locations
| where RegistryKey has_any ("\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", "\\Policies\\Microsoft\\Windows\\System")
// Value that controls the shutdown button on the logon screen
| where RegistryValueName =~ "ShutdownWithoutLogon"
// Detect it being set to 0 (disabled)
| extend NewValDec = tolong(extract(@"\d+", 0, tostring(RegistryValueData))),
         OldValDec = tolong(extract(@"\d+", 0, tostring(PreviousRegistryValueData)))
| where NewValDec == 0 or RegistryValueData has "0x00000000"
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, PreviousRegistryValueData, RegistryValueData,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessSHA256
| order by TimeGenerated desc

DeviceRegistryEvents
| where (tolower(RegistryKey) contains "\\policies\\system" or tolower(PreviousRegistryKey) contains "\\policies\\system")
| where isnotempty(RegistryValueName) or isnotempty(PreviousRegistryValueName)
| extend ChangedValue = tostring(coalesce(RegistryValueName, PreviousRegistryValueName))
| extend ChangedValueLower = tolower(ChangedValue)
| where ChangedValueLower matches regex @".*(shutdown|shutdownwithoutlogon|noclose|hide|power|close|remove).*"
| project Timestamp, DeviceName, RegistryKey, PreviousRegistryKey, RegistryValueName, PreviousRegistryValueName, RegistryValueData, PreviousRegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType
| order by Timestamp desc
| take 200

DeviceRegistryEvents
| where RegistryKey contains "\\Policies\\System" or RegistryKey contains "\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
| where ActionType in ("SetValue", "Modify", "Create", "Write", "Delete") or isnotempty(RegistryValueName) or isnotempty(RegistryValueData)
| where tolower(RegistryValueName) in ("shutdownwithoutlogon","shutdownwithoutlogonui","noclose","shutdownwithoutlogon") or RegistryValueName has_cs "Shutdown" or RegistryValueName has_cs "NoClose"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType, RegistryKey, RegistryValueName, RegistryValueType, PreviousRegistryValueData, RegistryValueData
| order by TimeGenerated desc
| summarize Changes = count(), PrevValues = make_set(PreviousRegistryValueData), NewValues = make_set(RegistryValueData), LatestEvent = max(TimeGenerated) by RegistryValueName, DeviceName
| order by LatestEvent desc
| take 50

DeviceRegistryEvents
| where RegistryKey contains 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\System' or RegistryKey contains 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System'
| where ActionType has_any ('Set', 'RegistryValueSet')
| where RegistryValueName in~ ('NoClose', 'ShutdownWithoutLogon', 'DisableShutdown')
| project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, PreviousRegistryValueData
| order by Timestamp desc

DeviceRegistryEvents
| where Timestamp >= ago(30d)
| where RegistryKey has "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
| where ActionType in ("RegistryValueSet", "RegistryValueModified", "SetValue", "ModifyValue")
| where RegistryValueName in~ ("DisableShutdownButton", "ShutdownWithoutLogon", "HideShutdownButton")
| project TimeGenerated,
          DeviceName,
          ActionType,
          RegistryKey,
          RegistryValueName,
          PreviousRegistryValueData,
          RegistryValueData,
          InitiatingProcessAccountName,
          InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has "Policies\\System"
| where RegistryValueData == "0"
| summarize EventCount = count() by RegistryValueName, DeviceName
| order by EventCount desc

DeviceRegistryEvents
| where ActionType == "RegistryValueSet"
| where RegistryKey startswith "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System"
| summarize arg_max(TimeGenerated, *) by RegistryValueName
| project TimeGenerated, DeviceName, RegistryValueName, PreviousRegistryValueData, RegistryValueData
| sort by TimeGenerated desc