Where are the shutdown event tracker logs?

Discussion in 'Windows Server' started by Kirsten, Jan 3, 2006.

  1. Kirsten

    Kirsten Guest

    Where does shutdown event tracker logs the options I enter when I shut down
    the computer?

    Are there any statistics?

    Thanks!
     
    Kirsten, Jan 3, 2006
    #1
    1. Advertisements

  2. Kirsten

    CJS Guest

    Shutdowns events are located in the System Event log (Event 1074).

    You can filter for Source: USER32
    If your running windows 2003 and specify a reason, it will also be logged in
    the description.
    It should look something like this:

    Event Type: Information
    Event Source: USER32
    Event Category: None
    Event ID: 1074
    Date: 12/14/2005
    Time: 1:31:52 PM
    User: <username>
    Computer: <computername>
    Description:
    The process winlogon.exe has initiated the restart of computer
    <computername> on behalf of user <username> for the following reason: No
    title for this reason could be found
    Reason Code: 0x800000ff
    Shutdown Type: restart
    Comment:

    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.
    Data:


    I hope that helps.
     
    CJS, Jan 3, 2006
    #2
    1. Advertisements

  3. Miha Pihler [MVP], Jan 3, 2006
    #3
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.