How to log when user restarts PC

I need to log when users reboot this certain PC.  I believe I should go under admin tools - local security policy - local policy - audit policy...but I'm not sure which event to start loging and I don't want to log more than I need.  Is there any documentation on what exacly each of these policies track?  If not, can someone tell me which policy I should log to trap the "restart" or "shutdown" of the PC?
j_donald_cAsked:
Who is Participating?
 
Danny ChildConnect With a Mentor IT ManagerCommented:
you can check your System EventLog for event 6005 which shows the Event Log starting up.  This is a good indicator of a reboot.  Also check for 6006 - Event Log Stopping.

Event Type:      Information
Event Source:      EventLog
Event Category:      None
Event ID:      6005
Date:            18/06/2008
Time:            09:12:51
User:            N/A
Computer:      <YourPCname>
Description:
The Event log service was started.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0
 
j_donald_cAuthor Commented:
Thanks.  That will work.  And now I don't have to worry about loging one of these other areas.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.