Where are the shutdown event tracker logs?

Discussion in 'Windows Server' started by Kirsten, Jan 3, 2006.

  1. Kirsten

    Kirsten Guest

    Where does shutdown event tracker logs the options I enter when I shut down
    the computer?

    Are there any statistics?

    Kirsten, Jan 3, 2006
    1. Advertisements

  2. Kirsten

    CJS Guest

    Shutdowns events are located in the System Event log (Event 1074).

    You can filter for Source: USER32
    If your running windows 2003 and specify a reason, it will also be logged in
    the description.
    It should look something like this:

    Event Type: Information
    Event Source: USER32
    Event Category: None
    Event ID: 1074
    Date: 12/14/2005
    Time: 1:31:52 PM
    User: <username>
    Computer: <computername>
    The process winlogon.exe has initiated the restart of computer
    <computername> on behalf of user <username> for the following reason: No
    title for this reason could be found
    Reason Code: 0x800000ff
    Shutdown Type: restart

    For more information, see Help and Support Center at

    I hope that helps.
    CJS, Jan 3, 2006
    1. Advertisements

  3. Miha Pihler [MVP], Jan 3, 2006
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.