Shutdown Event Tracker provides a way for IT
professionals to consistently track why users restart or shut down their
computers. It does not document why users choose other options, such as Log
off and Hibernate. It gathers the reasons users give for restarts and
shutdowns to help create a comprehensive picture of an organization's system
environment.
You can later view the Shutdown Event
Tracker log by searching for the User32 1076 event in the Event Viewer
console under the System Log.
This event refers to the failure indicated
by the previous Event Log 6008 event. The User32 1076 event is written when
the first user with shutdown privileges logs on to the computer after an
unexpected restart or shutdown and supplies a reason for the occurrence. An
unexpected restart or shutdown is one that the system cannot anticipate,
such as when the user pushes the computer's reset button or unplugs the
power cord.
Shutdown Event Tracker is enabled by default and supported on
all Windows Server 2003 family of operating systems.
To disable Shutdown Event
Tracker perform the following:
- Open Group Policy, then load the group
policy you want to apply the change to.
Note: On a computer that is not a
part of a domain you can set this feature locally by running GPEDIT.MSC
from the Run command.
For example, if you want the setting to affect the
entire domain, edit the Default Domain GPO, or another GPO on the domain
level.
- Expand Computer Configuration >
Administrative Templates > System.
- Double-click Display Shutdown Event
Tracker.
- Select Disabled.
- Click OK to close all dialog boxes.
- If you want the change to take place right now,
refresh the GPO by running the following command in a Command Prompt
window or from the Run command: