• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 156
  • Last Modified:

Where is a shutdown logged on a Windows 2000 Pro PC?

I have scheduled a daily (nightly) shutdown on a Windows 2000 Pro PC (being used as a server in a peer-to-peer network) so that a user's PST file is forced closed to enable the backup utility to run (an hour later). I have used the Task Scheduler and pointed it to shurdown.exe with the -r , -f switches (restart, force applications to quit). However, it doesn't appear the system is shutting down (set for 2:00am) and I am trying to confirm. I thought this shutdown would be logged somewhere in the event viewer but I cannot find anything there. Am I missing something or is it more likely that my scheduled task isn't working and that's why it isn't logged?
  • 2
3 Solutions
Instead of using Task Schedular, use the command AT

at 02:00 shutdown /l /r /y /c
ascendantdataAuthor Commented:
Any idea how to find a shutdown event in Event Viewer?
Look Under Winlogon as the source, but I belive only attempts to stop a shutdown by a service are logged that way.....

If you go to start>run>Secpol.msc>Local Policy>Audit Policy, and enable System Events for Success and Failure, it should get you what you need....

The event logger starting and stopping

Source: EventLog
EventID: 6006 (stop on shutdown)
EventID: 6009 (start on startup)

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now