remote shutdown dos how to trace

Somebody shutdwon my pc through DOS, how can you track that to see who did it?
Who is Participating?
dlb6597Connect With a Mentor Commented:
look in the System event log

Bear in mind that it could be the user logged on and then initiated the command under alternate credentials (i.e. the System account).
Thus, you may also want to check the security logs around that time to see who actually logged onto the console...
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.