Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Where can I find the last time the system was properly or improperly shutdown through the logs of Windows XP and Windows Server 2003?

share|improve this question
up vote 2 down vote accepted

Best Solution

You first need to enable the Shutdown Event Tracker. Steps for both Windows 2003 and XP are found here. Afterwards you just go to the event viewer and check it from there. An overview of it can be found here at Microsoft's TechNet Overview of Shutdown Event Tracker.

Work Around

If you are looking for that improper shutdown that has already accrued then that is a little harder. If you are able to find the GroupPolicy Opertional log then what you could do is look for key words: StartShell and EndShell. If you see two StartShell for the same session with a EndShell between it then you know that it was shutdown incorrectly. Windows wouldn't be able to EndShell for session if the power was suddenly interrupted.

Note: I found the workaround solution on a Windows 7 system. I don't know if XP or 2003 has this too.

share|improve this answer
"By default, Shutdown Event Tracker is enabled for all Windows Server 2003 operating systems and for Windows XP 64-Bit Edition Version 2003."..."By default, Shutdown Event Tracker is disabled in Windows XP Professional." – Moab Dec 1 '10 at 2:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .