systemd-user-sessions.service
/lib/systemd/systemd-user-sessions
systemd-user-sessions.service is a service that controls user logins. After basic system initialization is complete it removes /run/nologin, thus permitting logins. Before system shutdown it creates /run/nologin, thus prohibiting further logins. At the same time it also kills all user processes, so that system shutdown may proceed without any remaining user processes around.
systemd(1), systemd-logind.service(8), pam_nologin(8)